GOMAX ULTIMATE 5.47.0 turns GOMAX's security scorecard into a full protection suite: you can switch on login-attempt lockouts, rate-limiting for public API calls, author-enumeration and REST-users blocking, one-click XML-RPC disable, a core-file integrity check against WordPress's official checksums, and a malware-pattern scan of your uploads folder — every one opt-in, reversible, and running entirely on your own site. The scorecard tells you what's weak; now GOMAX can actually stop the common attacks.
Most WordPress break-ins don't use exotic exploits — they brute-force logins, hammer XML-RPC, harvest usernames, and hide PHP in the uploads folder. This release closes those doors, with each protection off by default so you enable exactly what you want.
Key takeaways
Login lockouts. After a set number of failed logins, the offending IP is locked out for a chosen window — with an email alert and a security.lockout webhook.
API rate-limiting. Unauthenticated calls to the GOMAX REST namespace (your public agent endpoints) are rate-limited per IP; logged-in admins are never limited.
Close enumeration & XML-RPC. Block ?author=N username harvesting, hide the REST users endpoint from anonymous visitors, and disable XML-RPC in one switch.
Integrity & malware checks. Compare core files to the official WordPress checksums, and scan the uploads folder for executable PHP and suspicious code patterns.
Full visibility. A security event log, a lockout list, and one-click unlock — all on your own server, nothing sent anywhere.
What each protection does
Login protection watches failed logins per IP. Cross the threshold and that IP is blocked for the lockout window; you get an email and a webhook so your other tools know. A successful login clears the counter.
Rate-limiting caps how many requests an unauthenticated visitor can make to GOMAX's REST endpoints in a time window — the practical defence for public AI-agent endpoints against abuse and scraping. You stay unaffected when logged in.
Author-enumeration blocking stops the classic ?author=1 trick that reveals usernames; REST-users protection hides /wp/v2/users from anonymous callers for the same reason.
XML-RPC disable shuts down a legacy endpoint that's a frequent brute-force and pingback-DDoS vector, if you don't use it.
Integrity check downloads the official checksums for your exact WordPress version and flags any core file that's been modified or is missing — a fast way to spot tampering.
Uploads scan looks for .php files that shouldn't be in /uploads and for suspicious patterns (eval, base64_decode, shell_exec…), which are common signs of an injected backdoor.
Safe by default, reversible always
Nothing here changes until you turn it on, and everything can be turned back off just as easily — these are settings, not irreversible edits to your site. That means you can tighten security gradually and roll back instantly if a protection is too strict for your workflow. And because it's first-party, the lockout list, the event log and the scans all live on your own server; the only outbound request is the integrity check reading WordPress's official checksums.
Frequently asked questions
Will login lockouts lock me out too? Only if you exceed the failed-attempt threshold from your IP — and you can set the threshold and lockout duration. If it ever happens, unlock_ip releases any IP immediately, and a successful login clears the counter automatically.
Does rate-limiting affect me as the admin? No. Logged-in users (including you) are never rate-limited. The limit only applies to unauthenticated requests to GOMAX's public REST endpoints, which is exactly where abuse comes from.
Is disabling XML-RPC safe? For most modern sites, yes — few things still need it. If you use the WordPress mobile app or certain pingback features you may want it on, so it's an opt-in switch you can reverse anytime.
How does the integrity check work without a security cloud? It fetches the official file checksums for your WordPress version from api.wordpress.org (WordPress's own service) and compares them to your files locally. Nothing about your site is uploaded — it only downloads the reference checksums.
What should I do if the uploads scan finds PHP files? Investigate them. Legitimate media uploads are images, PDFs and documents — executable PHP in the uploads folder is a common sign of a backdoor. The scan lists the files so you can review and remove anything you didn't put there.
