Complaints to the FBI in 2024
859,532
FBI IC3 2024. Internet crime, not only WordPress.
A top WordPress security plugin
Stop WordPress hacks before they wreck your site.
Most sites get hit through outdated plugins, themes, or a weak login. Bedrock is the security plugin plus Hub that blocks attacks, locks down login, and watches the files. Setup never requires a DNS change.
Product preview. Same Hub dashboard. Not a live account.
Account
BASIC · Active
Live
Protected
You are protected
Bedrock is on this site. You never had to change DNS.
What Bedrock covers
Events last 14 days
Sites
1 of 1 seats usedthis-site
why this matters
Internet crime costs real money.
FBI figures for all internet crime. Not a WordPress-only count. Not a customer count.
Reported losses in 2024
$16.6 billion
Up 33% from 2023. FBI Internet Crime Complaint Center.
Listed US cleanup price
$199
SiteLock lists $199. Ours is $199 once.
Sources: FBI IC3 2024 IC3 report PDF SiteLock $199
Black October
Is your PHP fixed yet?
October 2026 opened two critical holes in PHP (CVE-2026-109618 and CVE-2026-109619). Most sites still need the host update. Bedrock finds the risk, alerts the same day, hardens what it can, and watches while the host patches.
Find the risk
We read the PHP that answers the web. Status is Patched, At risk, or Unknown. Unknown often means the host installed a fix, but PHP still needs a restart.
Alert the same day
Watch can email, Slack, or ping a webhook when PHP is at risk. Quiet hours do not mute this class. The note names the CVEs and the minimum official fix for that branch.
Harden what we can
A config switch and optional Cloudflare edge rules lower the chance of a hit. They do not fully fix the bug. Only a patched PHP plus a worker restart does.
Source: CISA (updated 2026-10-23) and PHP.net archive 2026-10-21. Bedrock does not patch PHP itself.
AI attack defense
AI makes WordPress attacks faster
Bots now try stolen passwords and old plugin holes in seconds. Bedrock stops the automated wave, watches for takeover, and Care can clean up if the site is already hit. It does not patch PHP. It is not bulletproof.
Stop the wave
Login limits run per IP and per username. Empty user-agents, probe sequences, and 404 storms get dropped. Training scrapers stay out. Search bots stay in.
Watch for takeover
The scanner looks for new admin users, a changed wp-config, PHP in uploads, and a tampered Shield file. Watch can email, Slack, or ping a webhook the same day.
Cleanup if already hit
If the site is already broken, Shield Care includes one cleanup a year. A la carte cleanup is $199 once, with priority support.
October 2026 campaigns (SOCRadar on CyberXero) showed webshells dropped after a hole was found. CISA tracks PHP2Shell (CVE-2026-109618, CVE-2026-109619). Bedrock does not invent extra counts.
Skilled attacker defense
A skilled person still has to get past Bedrock
Someone who already knows WordPress can try to create an admin in seconds after a REST batch trick. Bedrock interrupts that known chain, finds hidden admins and buried backdoors, and locks a stolen admin session. It cannot guarantee a fresh 0-day. It is not bulletproof.
Stop the chain
Anonymous REST batch posts with triple-slash paths get dropped on the host. Cloudflare can add the same edge rule when connected. Search and checkout webhooks stay up.
Catch a takeover in flight
A new admin outside wp-admin raises a critical Watch alert. Skilled mode can downgrade that user and sign sessions out. Bedrock does not silently delete people.
Hunt what scanners miss
The scan looks for hidden must-use plugins, site-health option mimics, wp-config loaders, planted plugin folders, and PHP under uploads. Host crontab is outside plugin reach. Ask the host to check account cron if a backdoor returns.
Bitdefender MDR and InMotion Hosting wrote up the 2026 wp2shell chain (CVE-2026-63030 REST batch route confusion and CVE-2026-60137 WP_Query SQL injection). Bedrock does not invent extra counts.
Self-healing mesh defense
Hidden hacks try to put themselves back
A skilled person can hide a loader in a drop-in file or a tiny .user.ini so cleanup fails. Bedrock Shield hunts that mesh and locks the theme editor. It cannot stop every loader that already ran before WordPress. It is not bulletproof.
Hunt the mesh
The scan looks for auto_prepend, hostile drop-ins, theme fence code, the same fake plugin in two folders, hex ZIP bundles, and hidden admins.
Lock the easy paths
Stop skilled attacks closes the theme editor and blocks plugin zip uploads from the dashboard. Updates still go through Plugins, Hub, or the host.
Clean up in order
First stub the prepend. Then clear options and cron. Then remove hidden admins. Then delete the files in one pass. Shared-memory and immutable files need the host.
The Hacker News and Monarx wrote up the October 2026 SC self-healing mesh. Bedrock does not invent extra counts.
Reinfection and credential theft
Stolen passwords try to let them back in
After a first cleanup, some hacks steal the admin password, plant a secret login link, or leave a Service Worker in the browser. Bedrock Shield hunts those leftover doors. It cannot wipe another browser. It is not bulletproof.
Catch stolen passwords
The scan looks for hidden password dumps and login filters that store what you type. After a finding, rotate every administrator password and the WordPress salts.
Close secret login doors
Passwordless helper files and query tricks that mint a cookie without a password get flagged. Stop skilled attacks can block those cookies and quarantine the helper PHP.
Clean the leftover doors
Unregister Service Workers on every admin device. Treat other sites under the same host user as dirty. If this is a store, rotate payment and gateway keys.
Public October 2026 reporting on SC 4.0.3 and Apex Logger (mdpabel, ProWebCare, Monarx, TopSyde). Bedrock does not invent extra counts.
Supply chain and trusted scripts
Bad updates can sneak in
We watch the update path and fake Woo plugins. A poisoned Pro host or a trusted script can plant a hidden admin. Bedrock cannot rewrite every CDN script. It is not bulletproof.
Watch the update path
The scan looks for update hosts that are not wordpress.org and not the last host we saw. Stop skilled attacks can block a sudden host change.
Catch fake Woo plugins
Folders like woocommerce-notifications, plus Adminer or Tiny File Manager under plugins, get flagged. Delete the dropper and the second-stage plugin.
Clean after a finding
Rotate every administrator password, 2FA seeds, and the WordPress salts. Download Pro zips from the vendor dashboard, not an old CDN. Treat upstream JS vendors as a trust boundary.
Public cases: State of WordPress 2026, WP Beacon Essential Plugin hijacks, Fluent Forms / Rank Math PRO / MonsterInsights / ShapedPlugin / WowShipping update-channel compromises, and Sansec OptinMonster-style upstream JS. Bedrock does not invent extra counts.
Encrypted offsite copy
Always keep 1 safe copy off your host
If someone takes over your hosting login, a locked copy should still sit somewhere else. We lock the copy before it leaves. A copy on the same computer does not count.
Protected, At risk, or Unknown
Protected means we checked an encrypted copy in a bucket off this host inside the keep window. Missing keys or only a local copy is At risk. Never checked is Unknown.
Your bucket or env keys
Paste Amazon S3, Cloudflare R2, or Backblaze keys in Hub Backups. Click Show to see them. Server environment keys still work and win if set. Bring your own bucket this round.
Keep the last good copy
We never delete the last good offsite copy when a new copy fails. If this computer looks dirty, restore the Hub offsite copy taken before the hack.
Needs a bucket and keys. An attacker who also has those keys is out of scope. First Protected needs a successful run. This is not a substitute for host patching. Bedrock does not invent extra counts.
Own API and Site keys
Site keys stay hidden until you click Show
The Hub hides whether a guessed Site ID exists. A wrong or old key gets the same answer. Keys are as safe as your Hub login plus the Show click. This is not unhackable.
Guesses stay quiet
Unknown, wrong, and revoked keys all pay for the same HMAC work and return unauthorized. Watch raises Site key stuffing when someone tries many IDs.
Rotate and disconnect
Generate a new key if one leaked. Disconnect keeps the Site ID and kills the old key. Both ask for your password. Other Hub sessions are signed out.
After a Hub login scare
Sign out other sessions and change the Hub password. That revokes every Site key. Site IDs stay. Click Show, copy the new key, and paste it in WordPress Connect. Bucket keys and Cloudflare tokens need your password to Show. Site key Show stays a click. We never email a Site key.
Public citations: OWASP API Security Top 10 2023 (API2 Broken Authentication), CWE-798, NIST SP 800-57. A stolen Hub session can still click Site key Show until you sign out other sessions.
Cleanup access
Cleanup needs WordPress access. Operators reveal it once
We need access to clean your site. Share WordPress login. Hosting login helps if we need server files. Site key Show stays a click. This is not unhackable.
Share login on the status page
After you pay $199, the ticket waits on access. Share the WordPress login URL, username, and password, or a temp admin invite. Hosting company, panel URL, and SSH or SFTP notes help if we need server files. Do not send your WordPress password in email. You can update or remove access later.
Sealed, then Show
Access is sealed at rest. Operators see it masked until they click Show. Show does not ask for a password. The click is audited. Notes still refuse secret-shaped text. Care create still takes the same six-ticket floor. A closed account cannot submit. Site key Show stays passwordless and rate limited.
Team queue
Operators list paid, awaiting access, ready, in progress, and done tickets. They can mark access verified, start work, and complete. Work cannot start without WordPress access. Subscriber REST privilege stays blocked. Untrusted X-Forwarded-Proto is ignored. Plugin download is no-store. Leftover dump files stay off the Hub router. This is not unhackable.
Public citations: OWASP API Security Top 10 2023 (API1 Broken Object Level Authorization, API2 Broken Authentication), OWASP CSRF Prevention Cheat Sheet, CWE-311, CWE-312, CWE-523. A stolen Hub session can still click Site key Show or cleanup Show until you sign out other sessions.
Marketing home
Same fonts. Same prices. A calmer page.
The public site now uses spacious cards, cited security numbers, and Connect, Protect, Restore. Type is Satoshi. Basic is $15 / month. Cleanup is $199 once. Checkout still collects email. This is not unhackable.
Cited stats, not sample ads
Metric cards use the FBI IC3 2024 Internet Crime Report and SiteLock's $199 cleanup price. We do not invent a customer count or fake ad return. Cleanup costs more than Basic. Site key Show stays passwordless.
Connect, then Protect, then Restore
Install the plugin zip. Paste Hub URL and keys once. Leave Protect on. Already hacked? Cleanup is $199 once. Work still cannot start without WordPress access. A closed account cannot submit.
Pay first stays
Pricing posts to Checkout. Stripe or this Hub test Checkout asks for email. We do not publish a live domain or live Stripe from this build. Hub Referrer-Policy stays same-origin. Care create still takes the same six-ticket floor. This is not unhackable.
Public citations: FBI IC3 2024 Internet Crime Report and SiteLock fix-hacked-site. A stolen Hub session can still click Site key Show or cleanup Show until you sign out other sessions.
Marketing layout
Clear type. Same prices. A tighter page.
Home and pricing now use a two-column hero, soft cards, numbered Connect Protect Restore steps, and a taller recommended Pro card. Type is Satoshi. The accent is electric blue. Basic is $15 / month. Cleanup is $199 once. Checkout still collects email. This is not unhackable.
Layout, not copy
Eyebrows stay uppercase and tracked. Cards use a light line and a 22px radius. Feature cards sit on a pale inset. We did not copy another product's words or invent ad metrics.
Cited stats stay
Metric cards use the FBI IC3 2024 Internet Crime Report and SiteLock's $199 cleanup price. Cleanup costs more than Basic. Site key Show stays passwordless.
Pay first stays
Pricing posts to Checkout. Stripe or this Hub test Checkout asks for email. We do not publish a live domain or live Stripe from this build. This is not unhackable.
Public citations: FBI IC3 2024 Internet Crime Report and SiteLock fix-hacked-site. A stolen Hub session can still click Site key Show or cleanup Show until you sign out other sessions.
why this matters
Why your site is a target
Three common doors. Then the Bedrock fix for each one.
Outdated plugin
Old plugins and themes are the usual way in.
What Bedrock does
Watches files. Patches on Pro.
Scanner on Basic. Hub-issued virtual patches on Pro.
Weak login
Guessed passwords become a takeover.
What Bedrock does
Lockouts and two-factor
Brute-force lock and TOTP stay on. You never change DNS.
Invisible spam / deface
Visitors see junk. You may not notice yet.
Protected
You are protected
The Hub dashboard shows this site checked in. Leave defaults on.
why this matters
Hacks cost real money.
Internet crime costs real money. These FBI numbers cover all internet crime, not only WordPress.
859,532
complaints to the FBI in 2024
Internet crime reports. Not a WordPress-only count.
$16.6 billion
reported losses in 2024
Up 33% from 2023. FBI Internet Crime Complaint Center.
$199
listed US cleanup price
SiteLock lists $199. Ours is $199.
Sources: FBI IC3 2024 IC3 report PDF SiteLock $199 Google Safe Browsing The FBI totals are all internet crime, not a WordPress infection count.
why you need this
What a hack does
Bots hit every site they find.
more than 2,000
complaints every day
33%
higher reported losses than 2023
The FBI letter says more than 2,000 complaints a day over the past five years. That is all internet crime. Google Safe Browsing still flags unsafe sites.
Google warning
Google can say "This site may harm your computer."
Bedrock stops it The scan finds the bad files.
Lost sales
A down site gets no leads or sales.
Bedrock stops it Lockouts and the firewall stay on.
Host shutdown
Your host can turn the site off.
Bedrock stops it The scan stops the malware first.
Stolen data
A stolen login can reach customer data.
Bedrock stops it Lockouts stop guessed passwords.
Search spam
Hidden spam links can hurt your rank.
Bedrock stops it The scan finds files that changed.
Bots
Bots hit small sites. No one picks you.
Bedrock stops it The firewall sits on WordPress.
what it does
Bedrock stops the attack.
The plugin sits on WordPress. No DNS change.
Firewall
Stops bad requests on the site.
Malware scan
Watches files and uploads.
Login protection
Stops guessed passwords.
Alerts
Hub lists old plugins.
The Hub
One dashboard after you connect.
without vs with
What changes
Without Bedrock Shield
- Logins stay open to guesses.
- You find out too late.
- A listed cleanup price is $199.
With Bedrock Shield
- Lockouts and firewall run.
- The scan watches files.
- Cleanup is $199 once.
We help protect your site.
Install. Connect once. Leave it on.
How it works
Connect. Protect. Restore.
Three steps. Then leave Protect on. Install the plugin zip, paste Hub URL and keys once, then watch alerts and fixes. You never change DNS.
- Connect Install the plugin zip. Download first. Then upload in WordPress: Plugins, Add New, Upload Plugin. Paste Hub URL and keys once under Bedrock Shield, then Connect to the Hub. You never change DNS.
- Protect Leave Protect on. Get alerts and fixes. The Hub shows check-ins, update alerts, and what the plugin already blocked.
- Restore Already hacked? Cleanup is $199 once, not a plan. Shield Care includes 1 cleanup per year.
on by default
The safety net most WordPress sites skip.
One plugin. One Hub. You never change DNS.
Login protection
Brute-force lockouts on wp-login. The open door on most WordPress sites.
Two-factor
TOTP on WordPress and on the Hub account. Backup codes shown once.
Malware scan
File integrity plus a malware scan. Any install can quarantine a file by hand. Pro can auto-quarantine.
Virtual patching
Hub-signed rule packs on Pro.
Alerts
High-severity update alerts on Pro. Open Alerts, then update in WordPress.
Lockdown
Protect lockdown on the site while you patch. Leave defaults on.
On the site
One plugin. One Hub.
The plugin sits on WordPress. The Hub shows check-ins, alerts, and what already blocked. You never change DNS.
what is included
Three plans. Locked prices.
Pick a seat. Connect once. Leave the defaults on.
Recommended start
Basic
$15 / month or $119 / year
- Login lockouts and two-factor
- File integrity and malware scan
- Request firewall
- Hub dashboard
- Hub Watch from the outside (pings about every 15 minutes)
- Cloud firewall if you already use Cloudflare
- No DNS change
Most popular
Pro
$49 / month or $399 / year
- Everything in Basic
- Hub-issued virtual patches
- Vuln alerts and auto-quarantine
- Bot, geo, and shared blocklist
- Faster Hub Watch (about every 5 minutes)
Shield Care
$99 / month or $799 / year
- Everything in Pro
- 1 business day first reply
- 1 cleanup per year
- Post-cleanup report
- 14-day follow-up window
Pro 5-pack is $199 / month or $1,490 / year for five Pro seats. Already hacked? Cleanup is $199 once.
Questions
Ask the beginner questions.
Speed, DNS, hacks, and what we do not claim.
Still stuck on install or Connect? Open Help. A person reads cleanup tickets. We do not invent a live chat agent.
Open HelpWhat is Bedrock Shield?
Bedrock Shield is a WordPress plugin plus this Hub. Install the plugin zip, connect once, leave lockouts and the scanner on. You never change DNS.
Will it slow my site?
Bedrock runs as a WordPress plugin on the request, not as a DNS or CDN layer. Leave the defaults on. It does not sit in front of every image or script.
What if I'm already hacked?
A failed login lockout is not a hack. If the homepage changed, extra admins appeared, or spam links showed up, open Help, Was I hacked, then run a malware scan. If the site is already compromised, use the $199 cleanup. It is a one-time fee, not a subscription. Shield Care includes 1 cleanup per year.
Do I have to change my DNS?
No. Setup never requires a DNS or nameserver change. An edge CDN such as Cloudflare is optional and advanced, and it does require DNS if you add it later.
Do I need Cloudflare?
No. The default is the plugin plus this Hub. You never change DNS. Cloudflare or another edge CDN is optional and advanced only. If you already have a Cloudflare zone, Hub Cloud firewall can push our rules with a scoped token. That does not change DNS.
Does this work with AI-built WordPress sites?
Yes. If the site is public WordPress, Bedrock installs the same way. A generated theme does not add lockouts, two-factor, or a scanner.
Can I protect multiple sites?
Yes. Each site needs a paid seat. Pay per site, or get the Pro 5-pack at $199 / month or $1,490 / year for exactly five Pro seats. Extra Pro seats beyond a pack are $49 / site / month.
I already paid. What if I buy again?
Use the same email at Checkout. A higher plan upgrades the sites you have. The same plan adds that many sites. A cheaper plan adds seats billed at that plan. Account lists each site's plan. Cleanup is still $199 once and does not change the plan.
What do I get on Basic, Pro, and Shield Care?
Basic is $15 per site each month, or $119 per year: malware and file-integrity scanner, request firewall, login protection, two-factor, logs, and dashboard. Pro is $49 per month or $399 per year and adds virtual patching, vulnerability scanning, bot and geo controls, a shared blocklist, malware removal, and priority alerts. Shield Care is $99 per month or $799 per year: everything in Pro, a 1-business-day first reply, 1 included cleanup, a post-cleanup report, a 14-day follow-up on the same ticket, and 365-day activity. We do not quote competitor Care prices (public figures conflict) and we do not promise a 1-hour or 24/7 response.
Two-factor is required, right?
No. Two-factor is optional until you enroll on your Profile. Lockouts and the scanner stay on from the defaults.
Ready
Protect this WordPress site.
Install, connect once, leave defaults on. Setup never requires a DNS change.