"No external libraries. No blind trust. No compromise." AGPLv3 — Open Source Core. Built for humans, not for SaaS margins.
This project is a Proof of Concept (PoC) and part of ongoing research and development at VisionGaia Technology. It is not a certified or production-ready product.
Use at your own risk. The software may contain security vulnerabilities, bugs, or unexpected behavior. It may break your environment if misconfigured or used improperly.
Do not deploy in critical production environments unless you have thoroughly audited the code and understand the implications. For enterprise-grade, verified protection, we recommend established and officially certified solutions.
Found a vulnerability or have an improvement? Open an issue or contact us.
- NEW MODULE: VGT Shield — SHA-256 Proof-of-Work Anti-Bot Engine (Zero-UI, Zero-Cloud, DSGVO-compliant)
- Security: All database outputs now fully escaped — comprehensive output escaping across the entire codebase
- WordPress Marketplace Compliance: All files reviewed and adapted to meet official WordPress plugin guidelines
- MU-Deployer: Removed one-click deployment — the plugin now generates a script that must be uploaded manually via FTP (WordPress policy requirement)
- Red Team Validation: 3 Python-based red team test scripts added to the repository for community validation of Sentinel CE
- Ongoing: New regex filter signatures added to AEGIS
- Ongoing: Internal red team evaluation sessions to continuously improve Community Edition coverage
VGT Sentinel Community Edition is a modular, zero-dependency WordPress security framework engineered to neutralize deterministic attack vectors without sacrificing performance.
It is the open-source core of the VGT Sentinel suite — a battle-hardened, multi-layered defense system built on a Zero-Trust architecture. Every request is inspected, every header hardened, every upload analyzed, every file hashed, and every bot challenged.
Traditional WordPress Security:
→ Single plugin = single point of failure
→ Shared hosting overhead
→ No outbound control
→ No filesystem integrity monitoring
VGT Sentinel ZTNA Security Stack:
→ Stream-based WAF (AEGIS) — SQLi, XSS, RCE, LFI neutralized
→ Kernel Hardening (TITAN) — Server fingerprint masked
→ Stealth Engine (HADES) — WordPress architecture obfuscated
→ Access Guard (CERBERUS) — IP-validated brute-force prevention
→ Outbound Control (STYX LITE) — Data exfiltration blocked
→ Payload Sanitizer (AIRLOCK) — Binary upload inspection
→ Integrity Monitor (CHRONOS) — SHA-256 filesystem diff-hashing
→ Anti-Bot Engine (VGT SHIELD) — Zero-UI PoW bot defense (NEW)
Incoming HTTP Request
↓
CERBERUS (Pre-Auth IP Validation)
→ Cloudflare CIDR verification
→ X-Forwarded-For spoofing prevention
→ Brute-force state via RAM/Object Cache
→ Hook Priority 1 — fires before WP user logic
↓
AEGIS WAF (Stream Inspection)
→ php://input scanned in 4KB binary chunks
→ Overlap-buffer for boundary-spanning patterns
→ 512KB scan limit (Memory Exhaustion prevention)
→ Tarpit: Socket-Drop + Connection: Close on critical hit
↓
TITAN (Kernel Hardening)
→ Security headers injected
→ X-Powered-By camouflage (Laravel / Drupal / Django)
→ XML-RPC blocked, REST API locked to auth sessions
→ .env / wp-config.php / .git access denied at .htaccess level
↓
HADES (Stealth Engine)
→ URL rewrites mask WordPress directory structure
→ Custom slugs for wp-admin and wp-login.php
↓
VGT SHIELD (Anti-Bot / PoW Engine) ← NEW IN V1.5.0
→ SHA-256 cryptographic challenge issued by PHP server
→ Web Worker mines proof-of-work in isolated browser thread
→ X-VGT-Shield-PoW header injected into form submissions
→ Server validates hash in <10ms — replay protection (TTL 1800s)
↓
AIRLOCK (Upload Inspection)
→ Magic Byte analysis on 4KB header/footer chunks
→ PHP wrapper, Base64 and exec-pattern detection
→ Polyglot file prevention
↓
CHRONOS (Async Integrity Monitor)
→ SHA-256 against integrity_matrix.php baseline
→ mtime + size pre-filter before hash computation
→ Ghost Trap honeypot triggers IP blacklisting on access
→ Cron-sliced execution (max 20s) — PHP timeout safe
↓
STYX LITE (Outbound Control)
→ Telemetry Kill Switch for api.wordpress.org
→ Supply-chain exfiltration blocked
Stream-based WAF for real-time payload inspection.
| Parameter | Value |
|---|---|
| Engine | Deterministic Regex Pattern Matching |
| Scan Limit | 512 KB (Memory Exhaustion prevention) |
| Read Strategy | php://input binary stream in 4KB chunks with overlap buffer |
| Protected Vectors | SQLi, XSS, RCE, LFI, Malicious User Agents |
| Threat Response | Immediate socket-drop (Connection: Close) before header send |
Application-layer hardening and server signature masking.
Headers Enforced:
→ X-XSS-Protection
→ X-Frame-Options: SAMEORIGIN
→ X-Content-Type-Options: nosniff
→ Referrer-Policy
→ Permissions-Policy
Camouflage Engine:
→ X-Powered-By spoofed to: Laravel | Drupal | Django
API Lockdown:
→ XML-RPC: BLOCKED (full)
→ REST API: Auth-only sessions
→ RSS/Atom: DISABLED
Protected Paths (.htaccess):
→ .env | .git | wp-config.php | composer.json | Vault directories
Architecture obfuscation to prevent automated WordPress fingerprinting.
URL Rewrite Map:
| Original Path | Masked Path |
|---|---|
wp-content/themes |
content/ui |
wp-content/plugins |
content/lib |
wp-content/uploads |
storage |
wp-includes |
core |
wp-admin |
(Custom Slug) |
wp-login.php |
(Custom Slug) |
Webserver Support: Apache (auto via .htaccess) · Nginx (static rule injection) · LiteSpeed
Pre-authentication IP validation and brute-force defense.
| Feature | Detail |
|---|---|
| True-IP Detection | Native Cloudflare CIDR validation — prevents X-Forwarded-For spoofing |
| Fail-State Tracking | RAM/Object Cache via WordPress Transients |
| Hook Priority | 1 on authenticate — fires before any WP user logic loads |
Network-layer control against data exfiltration and supply-chain attacks.
Telemetry Kill Switch — Blocked Domains:
→ api.wordpress.org
→ downloads.wordpress.org
→ s.w.org
Supply-Chain Protection:
→ Blocks unintended external communication from compromised plugins
Binary-level analysis of all file uploads (multipart/form-data).
| Feature | Detail |
|---|---|
| File Policy | Strict allowlist — only pre-approved safe formats |
| Large File Strategy | Memory-safe chunked read — 4KB header/footer scan for files >2MB |
| Magic Byte Inspection | Detects real file type regardless of extension |
| Polyglot Prevention | Blocks PHP wrappers, Base64 obfuscation, exec-patterns in image/document payloads |
Asynchronous filesystem integrity monitoring with honeypot tripwire.
Differential Hashing:
→ SHA-256 verified against integrity_matrix.php (PHP-formatted — prevents web exposure)
→ mtime + size pre-filter: hash only runs when metadata changes
Ghost Trap:
→ Honeypot file: wp-admin-backup-restore.php
→ HTTP access = immediate IP blacklisting
Execution Safety:
→ Async State Machine — max 20s Cron-Slice
→ No PHP timeout risk on large installations
A high-performance, DSGVO-compliant reCAPTCHA alternative for WordPress. Eliminates bot interactions through a server-validated Proof-of-Work engine that operates entirely without user interaction and without external data transfers (Zero-Cloud).
No checkbox. No "I'm not a robot". No Google requests. No cookies. Instead: invisible, mathematical bot defense directly in the browser.
| Feature | Description |
|---|---|
| Zero-UI Bot Defense | End users see no captchas or checkboxes — security operates invisibly in the background |
| SHA-256 PoW Engine | Cryptographic challenge-response via bitwise hashing, isolated in a Web Worker |
| 100% DSGVO-compliant | No third-party requests, no cookies, no tracking |
| Zero-Cloud | Fully server-side — no external APIs, no CDNs |
| Replay Protection | Every hash is valid exactly once — TTL: 1800 seconds |
| Deep Plugin Scanner | AST-regex parsing detects installed form plugins and integrates them automatically |
| Network Layer Hijacking | Automatic interception of network requests for PoW header injection |
| <10ms Server Validation | Minimal latency on server-side hash verification |
| Dark/Light Mode | Neural Aesthetics admin dashboard with full theme support |
How it works:
Client (Browser)
│
▼
GET /wp-json/vgt-shield/v1/challenge
→ PHP server issues cryptographic challenge
│
▼
Web Worker (Isolated Thread)
→ SHA-256 Bitwise Hashing
→ Mines proof-of-work solution (no UI blocking)
│
▼
Form Submission / AJAX Request
→ X-VGT-Shield-PoW header injected
→ Server validates hash (<10ms)
→ Hash marked as used (replay protection)
│
▼
✅ Legitimate user → form processed
❌ Bot (no valid PoW) → request blocked
Native integrations: WooCommerce · Contact Form 7 · WPForms · Gravity Forms · WordPress Core Comments
The repository includes 3 Python-based red team test scripts for independent validation of Sentinel CE. These tools allow the community to verify that each module is functioning as expected against their own installations.
⚠️ Only use against your own servers. Running these scripts against third-party systems without explicit authorization is illegal.
| Script | Module Tested | Technique |
|---|---|---|
redteam_aegis.py |
AEGIS WAF | SQLi, XSS, RCE, LFI payload injection — validates block rate and response behavior |
redteam_cerberus.py |
CERBERUS | Brute-force simulation with IP rotation — validates fail-state tracking and lockout |
redteam_shield.py |
VGT SHIELD | Bot simulation without PoW — validates challenge-response enforcement |
Run them from an isolated environment after activating Sentinel CE on a test WordPress installation. Each script outputs a structured report with block rate, response codes, and latency metrics.
Zero performance tax. Maximum coverage.
| Optimization | Mechanism |
|---|---|
| Fast-Path Routing | Static assets bypass WAF inspection entirely — saves >90% CPU cycles |
| Stream Chunking | Payload inspection via chunked reads — low, stable RAM footprint |
| Async Scheduling | CHRONOS runs in time-sliced cron — never blocks request handling |
| Web Worker Isolation | VGT SHIELD PoW mining runs in isolated thread — zero UI blocking |
| Zero Dependencies | No external libraries — no supply chain risk, no overhead |
| Component | Detail |
|---|---|
| PHP | 7.4+ (Recommended: 8.1+) |
| Webserver | Apache (auto), Nginx (manual rule injection), LiteSpeed |
| Page Builders | Bridge Manager auto-disables conflicting DOM/header interventions for Elementor, Divi, Oxygen |
| VGT Ecosystem | Native VisionLegalPro support via Shadow-Net Asset Routing |
| VGT Myrmidon | AEGIS Co-op Mode — whitelists Myrmidon ZTNA API endpoints automatically |
| WordPress Marketplace | Fully compliant with WordPress plugin guidelines as of V1.5.0 |
As of V1.5.0, the entire codebase has been reviewed and adapted to meet official WordPress plugin directory guidelines:
- Output escaping: All database outputs and dynamic values are now fully escaped using WordPress core functions (
esc_html,esc_attr,esc_url,wp_kses) throughout the entire plugin - MU-Deployer: One-click MU plugin deployment has been removed per WordPress policy. The plugin now generates a ready-to-use script that must be uploaded manually to
wp-content/mu-plugins/via FTP or SFTP - Code Standards: All files reviewed for compliance with WordPress Coding Standards
DISCLAIMER: The Community Edition (Silber Status) operates on a deterministic rule engine. It provides a robust shield against standardized, automated botnets, scrapers, and known attack vectors.
The following capabilities are exclusive to VGT Sentinel Pro / Platin Status:
| Capability | Silber | Platin |
|---|---|---|
| ORACLE AI — Polymorphic Zero-Day Detection | ❌ | ✅ |
| PROMETHEUS — Dynamic Behavioral Profiling | ❌ | ✅ |
| NEMESIS — Deception-Engine | ❌ | ✅ |
ZEUS — Pre-Boot WAF via auto_prepend_file |
❌ | ✅ |
| MORPHEUS — Hypervisor for Plugins | ❌ | ✅ |
| GORGON — Global Swarm Intelligence Threat Feed | ❌ | ✅ |
| API CRYPTO VAULT — AES-256-GCM Database Payload Encryption | ❌ | ✅ |
| Deterministic WAF (AEGIS Lite) | ✅ | ✅ |
| Kernel Hardening (TITAN Lite) | ✅ | ✅ |
| Stealth Engine (HADES Lite) | ✅ | ✅ |
| Access Guard (CERBERUS) | ✅ | ✅ |
| Outbound Control (STYX LITE) | ✅ | ✅ |
| Payload Sanitizer (AIRLOCK Lite) | ✅ | ✅ |
| Integrity Monitor (CHRONOS) | ✅ | ✅ |
| Anti-Bot PoW Engine (VGT SHIELD) | ✅ | ✅ |
# 1. Clone into WordPress plugins directory
cd /var/www/html/wp-content/plugins/
git clone https://github.com/visiongaiatechnology/sentinelcom
# 2. Activate in WordPress Admin
# Plugins → VGT Sentinel Community Edition → Activate
# 3. HADES: Configure custom login slug
# Settings → Sentinel → Stealth Engine
# 4. CHRONOS: Generate initial integrity manifest
# Settings → Sentinel → Integrity Monitor → Generate Baseline
# 5. VGT SHIELD: Activate Anti-Bot PoW
# Settings → Sentinel → Shield → EnableMU-Deployer Note: One-click MU deployment is no longer available (WordPress policy). After activating Sentinel, navigate to Settings → Sentinel → MU-Deployer to generate the deployment script, then upload it manually to
wp-content/mu-plugins/via FTP.
On first activation, Sentinel automatically:
→ Injects AEGIS WAF into the request lifecycle
→ Applies TITAN security headers
→ Activates HADES URL rewrites (.htaccess / Nginx rules)
→ Initializes CERBERUS fail-state cache
→ Generates CHRONOS integrity_matrix.php baseline
→ Deploys Ghost Trap honeypot
→ Activates STYX outbound kill switch
→ Registers VGT SHIELD challenge endpoint (/wp-json/vgt-shield/v1/challenge)
| Tool | Type | Purpose |
|---|---|---|
| ⚔️ VGT Sentinel | WAF / IDS Framework | Zero-Trust WordPress security suite — you are here |
| 🛡️ VGT Myrmidon | ZTNA | Zero Trust device registry and cryptographic integrity verification |
| ⚡ VGT Auto-Punisher | IDS | L4+L7 Hybrid IDS — attackers terminated before they even knock |
| 📊 VGT Dattrack | Analytics | Sovereign analytics engine — your data, your server, no third parties |
| 🌐 VGT Global Threat Sync | Preventive | Daily threat feed — block known attackers before they arrive |
| 🔥 VGT Windows Firewall Burner | Windows | 280,000+ APT IPs in native Windows Firewall |
| Method | Address |
|---|---|
| PayPal | paypal.me/dergoldenelotus |
| Bitcoin | bc1q3ue5gq822tddmkdrek79adlkm36fatat3lz0dm |
| ETH | 0xD37DEfb09e07bD775EaaE9ccDaFE3a5b2348Fe85 |
| USDT (ERC-20) | 0xD37DEfb09e07bD775EaaE9ccDaFE3a5b2348Fe85 |
Pull requests are welcome. For major changes, open an issue first.
Licensed under AGPLv3 — "For Humans, not for SaaS Corporations."
VisionGaia Technology builds enterprise-grade security infrastructure — engineered to the DIAMANT VGT SUPREME standard.
"Sentinel was built because WordPress deserved a security framework that doesn't phone home, doesn't bloat your stack, and doesn't ask you to trust a SaaS dashboard with your attack surface."
Version 1.5.0 — VGT Sentinel Community Edition // Zero-Trust WAF Framework // Deterministic DFA Engine // WordPress Marketplace Ready // AGPLv3