PRE-BOOT ADMISSION · WAF · XDR · RASP · BEHAVIORAL HORIZON · DECEPTION · MERKLE INTEGRITY · EGRESS SHIELD · HARDENING · CRYPTOGRAPHIC VAULT · OPEN CORE
🏛️ Vollständige Architekturspezifikation:
ARCHITECTURE.md(Detaillierte Systemebenen, Invarianten, Pre-Boot Kernel-Abläufe & Dashboard-Struktur)📖 GeDefense WP 8.1.0 Benutzer- & Administrationshandbuch (PDF) — Das offizielle Handbuch für Administratoren, Entwickler und Sicherheitsbeauftragte:
- 🇩🇪 Deutsch: 📘 GeDefense_WP_Handbuch_8.1.0_FINAL.pdf
- 🇷🇺 Русский: 📕 GeDefense_WP_Handbuch_8.1.0_RU.pdf
- 🇬🇧 English: 📗 GeDefense_WP_Handbook_8.1.0_EN.pdf
Hinweis: Das Handbuch bietet praxisnahe Anleitungen zur Konfiguration, Bedrohungsanalyse und Systemhärtung für alle Benutzergruppen.
Changelog Overview: Version 8.1.0 represents a massive architectural leap, introducing the ZEUS Next Generation Pre-Boot Admission Kernel, the TRINITY Autonomous Closed-Loop XDR Fabric, formalized TITAN Assurance Lifecycles, and comprehensive Strict-Typing and Localization Refactoring across the entire platform.
Transformed ZEUS from a static filter into an ultra-fast, zero-allocation pre-boot admission control and edge defense kernel operating at Layer 0 prior to WordPress application boot.
- Deterministic Canonicalization Guard: Enforces strict URL decoding invariants before routing. Rejects double-percent encoding (
%252f), null-byte injections (%00), encoded directory slashes (%2f,%5c), unescaped backslashes, dot-segment traversals (..), duplicate path separators (//), and path depths exceeding 32 levels with immediate HTTP 400 rejection. - Host Header Invariant & RFC Host Lock: Validates Host header structure, lengths, and characters. Includes configurable Host Lock modes (
DISABLED,AUDIT,REJECT 421) strictly matching authorized canonical hostnames. - Request Envelope Firewall & Structural Ceilings: Enforces permitted HTTP methods (
GET,POST,HEAD,OPTIONS,PUT,PATCH,DELETE->405) and hard structural boundaries: Query Length (2048chars ->414), Parameter Count (100->400), Header Count (50->431), Aggregate Header Size (16 KiB->431), and Cookie Payload Size (8 KiB->400). - Route Contracts Engine: Enforces micro-firewall contracts per API route (e.g.
/wp-json/,/xmlrpc.php,/wp-login.php) with exact/prefix path matching, allowed method sets, payload body size limits (HTTP413), MIME/content-type enforcement (HTTP415), query limits, cross-site mutation policy (blockingSec-Fetch-Site: cross-sitestate changes with403), and route-specific rate budgets. - Zero-Allocation Request Budget Engine: Fast token-bucket rate limiter operating in APCu / atomic memory files. Enforces actor IP ceilings (default
180req/min) and/24(IPv4) //64(IPv6) subnet ceilings (default450req/min) with selectable action modes:THROTTLE(HTTP429),TEMPORARY_REJECT(HTTP503), orXDR_SIGNAL(Audit/Telemetry only). - Cryptographic Admission Tokens & Clean URL Exchange: Tamper-proof, short-lived HMAC-SHA256 admission tokens (
vgt1.<payload>.<sig>) with surface binding (admin,login,all), cryptographic expiry, and single-use nonce replay protection. Seamlessly exchanges query tokens (?vgt_adm=...) for Secure, HttpOnly, SameSite=Strict cookies with instant HTTP 302 redirects. - Incident Lockdown & Fortress Isolation: Emergency containment barrier requiring cryptographic admission tokens for all incoming requests, instantly mitigating volumetric DDoS and zero-day exploitation storms.
- Tamper-Evident Flight Recorder (Blackbox Spool): Append-only event spool with rolling HMAC-SHA256 hash chains, 300-second flood coalescing (updating repeat event counters in-place), Windows-safe atomic rotation, and boot-time draining into the WordPress Event Bus.
- Hardening Lab Microbenchmark & Self-Test: Integrated sub-microsecond microbenchmark evaluator (achieving
150,000+evals/sec) and automated 9-point self-test suite.
Unified multi-sensor security event fabric correlating signals across AEGIS, Prometheus, Morpheus, Styx, Cerberus, and Zeus with deterministic, automated containment.
- Two-Way Virtual Emergency Route Containment: When an active vulnerability or exploit is identified on a specific API endpoint (e.g.
/wp-json/vulnerable-plugin/v1/), TRINITY XDR instantly isolates that specific route prefix at Layer 0 inzeus-waf.phpwith HTTP503, while keeping the entire rest of the website 100% online and operational. - Hard Semantic TTL Engine: Automated responses (Single IP Bans, Subnet Containment, Zeus Route Containment, Mandatory Admission Enforcement, Morpheus Honey Overlays, Styx Egress Isolation) enforce exact semantic expiration timestamps (
expires_at), releasing containment automatically without requiring WP-Cron execution.
- Configurable TTL Policy Presets & Fine-Tuning:
CONSERVATIVE: 5 min Actor Ban / 10 min Subnet Containment / 5 min Route Isolation.BALANCED: 15 min Actor Ban / 30 min Subnet Containment / 15 min Route Isolation.AGGRESSIVE: 1 hour Actor Ban / 2 hours Subnet Containment / 1 hour Route Isolation.CUSTOM: Granular per-action second-level TTL fine-tuning.
- Granular Multi-Sensor Response Actuator Controls: Fine-grained switches in the policy engine allowing administrators to selectively arm or disarm individual containment actuators (Cerberus IP Ban, Zeus Route Quarantine, Zeus Pre-Boot Admission, Morpheus Micro-Tarpit, Styx Virtual Shadowing, Plugin Isolation).
- Containment Policy Modes & Escalation:
TEMPORARY_BY_DEFAULT: Standard automated containment with hard TTL recovery.TEMPORARY_ONLY: Strict policy prohibiting permanent edge bans.ALLOW_PERMANENT_EXPLICIT: Permits administrative permanent ban escalation.Escalation Policy: Repeat offenders within 24 hours receive an automatic 4x TTL multiplier.
- Deterministic Response Idempotency & Rollback: Response UUIDs are deterministically derived from
hash("incident|action|target"). Multi-sensor signals reuse active response IDs, and expired responses are rolled back atomically with full ownership protection. - Tamper-Evident Evidence Root: Correlated attack stories and security events are cryptographically sealed into Merkle evidence digests (
wp_vis_xdr_evidence).
Comprehensive visual, structural, and security refactoring of the entire administration interface into a responsive, high-contrast Cyber-Defense Cockpit.
- Unified Cyber-Defense HUD & Cockpit Styling: High-contrast, SOC/NOC-grade dark theme featuring monospace telemetric typography, pulsing activity nodes, glitch headers, synchronized HUD cards, and unified glassmorphic containers across all 34 module views.
- Universal Topbar & Form Security Synchronization: Global action bar featuring unified configuration persistence (
vis-topbar-save), automatic cryptographic CSRF tokens (wp_nonce_field('vis_save_config')) on every configuration view, and robust sub-tab preservation preventing unwanted redirects.
- Security Center (Assurance Plane Cockpit):
- 21 Deep Invariant & Architecture Checks: Evaluates strict runtime baselines, storage path jails, privilege boundaries, Merkle root consistency, memory execution boundaries, and HTTP validation contracts in real time.
- Interactive Live Audit Runner: Client-side audit execution engine with dynamic millisecond duration metering, live terminal log streaming, and reactive posture pills (
HARDENED,GUARDED,ATTENTION). - Visual Trust Boundaries & Capability Surface Matrix: Graphical representation of data flows from untrusted ingress to encrypted storage, and permission zones categorized from Trust Core down to Application extensions.
- TRINITY XDR NOC Cockpit:
- Graphical real-time NOC topology schematic mapping interlocks between AEGIS, Prometheus, Nemesis, and Cerberus.
- Threat vector distribution progress bar and live intercept audit feed.
- Dynamic Sensor Status Grid: Real-time operational monitoring across all 6 detection sensors reflecting active vs. standby module states (
ZEUS 6G WAF,AEGIS DPI,PROMETHEUS AI,NEMESIS DECOY,AIRLOCK INGRESS,MORPHEUS RASP).
- Dynamic JavaScript Localization Bridge (
#vsc-i18n): Seamless inline translation dictionary providing real-time internationalization for client-side terminal streams, toast notifications, and badge states without requiring page reloads. - System Status & Telemetry Cockpit: Live audit overview verifying system health, RAM-cache coverage (APCu / Redis), PHP runtime configuration, and module load integrity for all 19 core security components.
Formalized web assurance lifecycle, advanced browser security policies, and application surface hardening.
- 5-Stage Assurance Lifecycle: Formalized states (
IDLE->ANALYZING->STAGING->ENFORCING->RECOVERED) with atomic policy deployment and rollback. - Browser Security Policies: Hardened HSTS Preload headers, Sandbox Origin Verification, Secure Fetch Metadata validation, and automatic suppression of discovery links, emojis, and asset versions.
- Application Hardening: Hardened REST user enumeration defense, author scan blocking, XML-RPC honeytraps, feed suppression, and login gatekeeping.
Dynamic edge firewall synchronization and high-performance perimeter security.
- Dynamic XDR TTL Synchronization: Edge firewall exports (Nginx
deny, Apache.htaccess) dynamically verify active XDR response TTLs, ensuring temporary incident bans expire cleanly at the edge without manual rule cleanup. - Zero-Allocation CIDR Filtering: High-speed memory-cache lookups supporting IPv4
/24and IPv6/64subnets with Cloudflare trusted proxy CIDR resolution.
In-memory execution self-protection and outbound zero-trust communication control.
- Morpheus RASP Memory Defense: Call-stack inspection protecting sensitive WordPress database tables (
wp_users,wp_usermeta) and core options (siteurl,home,active_plugins) from unauthorized privilege escalation or malicious plugin mutations. - Styx Outbound Egress Shield: Intercepts
pre_http_requesthooks, enforcing outbound domain allowlisting, preventing data exfiltration, and blocking unauthorized WordPress core telemetry.
- 100% Dictionary Coverage: Mapped over 1,100 gettext phrases across all 34 dashboard views, settings panels, audit checks, and live telemetry cockpits into
de.php,en.php, andru.php. - Strict-Typing Sanitization & Escaping Audit: Every view and AJAX endpoint refactored with strict PHP 8.1+ types, explicit string casting on numeric outputs, and comprehensive escaping (
esc_html,esc_attr,esc_url,esc_textarea,wp_nonce_field).
GeDefense WP — Open Core is a modular, zero-dependency WordPress security platform designed as a multi-tier security kernel and active defense matrix for PHP 8.1–8.4 and WordPress 6.0+.
Instead of treating WordPress security as a single firewall rule set, GeDefense WP combines multiple defensive layers into one coordinated request and runtime pipeline:
- pre-boot admission control and request envelope rejection;
- deep packet inspection Web Application Firewall;
- behavioral threat scoring and event horizon tracking;
- autonomous closed-loop XDR and virtual route containment;
- cryptographic self-integrity verification (Merkle roots);
- Runtime Application Self-Protection (RASP);
- ingress file and upload entropy inspection;
- WordPress hardening and anti-enumeration;
- dynamic admin-path cloaking;
- honeypots and cyber deception;
- zero-trust outbound egress control;
- autonomous background integrity scanning;
- cryptographic secrets storage; and
- security posture auditing.
The core is designed to remain fully functional as an independent open-source security platform. Optional modules can be integrated through the Open Core module registry.
GeDefense WP is built around one principle: a request must earn trust as it moves deeper into the application stack.
- Documentation & Handbooks
- What's New in GeDefense WP 8.1.0
- Architecture
- Security Pipeline
- Core Module Matrix
- 1. ZEUS — Pre-Boot Admission Kernel
- 2. AEGIS — Deep Packet Inspection WAF
- 3. PROMETHEUS — Behavioral Threat Horizon
- 4. TRINITY XDR — Closed-Loop Response Fabric
- 5. Self-Integrity Engine
- 6. MORPHEUS — Runtime Application Self-Protection
- 7. NEMESIS — Deception Grid
- 8. TITAN — WordPress Hardening
- 9. HADES — Admin Stealth
- 10. CERBERUS — Perimeter Firewall
- 11. AIRLOCK — Ingress File Inspection
- 12. GHOST TRAP — Honeypot Layer
- 13. STYX — Outbound Egress Shield
- 14. CHRONOS — Autonomous Scanner
- 15. KEY VAULT — Cryptographic Secret Storage
- 16. ORACLE — Security Audit Engine
- 17. THRONEGUARD — Sovereign Privilege Sentinel
- 18. LOGINPAGER — Sovereign Login Surface
- 19. Module Registry / Open Core
- Zero-Dependency Philosophy
- Performance & Benchmarks
- Assurance & Regression Testing
- Requirements
- License
- Changelog History
GeDefense WP is organized as a multi-tier security kernel operating before, during, and after normal WordPress execution.
All GeDefense-owned runtime APIs use the canonical VisionGaia\GeDefense namespace. Core, dashboard, scanner, and module symbols are cleanly separated. Global VIS_ symbols remain fully ABI-compatible for WordPress hooks and third-party integrations.
flowchart TD
A[Incoming HTTP / HTTPS Request]
A --> L0[Layer 0: Pre-Boot Admission<br/>ZEUS + CERBERUS]
L0 --> L1[Layer 1: Self-Integrity<br/>Merkle Trust Anchor]
L1 --> L23[Layers 2-3: Ingress Inspection<br/>AEGIS WAF + PROMETHEUS]
L23 --> L45[Layers 4-5: Deception & Hardening<br/>TITAN + HADES + NEMESIS + GHOST TRAP]
L45 --> L67[Layers 6-7: Runtime & Egress<br/>MORPHEUS RASP + AIRLOCK + STYX]
L67 --> WP[WordPress Core / Themes / Plugins]
XDR[TRINITY XDR] -. 2-way containment .-> L0
XDR -. behavioral correlation .-> L23
XDR -. runtime overlay .-> L67
CHR[CHRONOS] -. background integrity .-> WP
ORA[ORACLE] -. posture audit .-> WP
VLT[KEY VAULT] -. cryptographic secrets .-> L0
Incoming requests traverse a deterministic multi-stage execution pipeline:
[ INCOMING HTTP / HTTPS REQUEST ]
│
▼
[ LAYER 0: PRE-BOOT ADMISSION CONTROL ]
├─ Host Header Invariant & RFC Host Lock (421)
├─ Canonicalization Guard (Traversals, Null-bytes, Double-encoding)
├─ Request Envelope Ceilings (Method, Query, Headers, Cookies)
├─ Route Contracts Engine (Methods, Body Bytes, Content-Types)
├─ Zero-Allocation Request Budgets (IP & Subnet Token Buckets)
├─ Cryptographic Admission Tokens (HMAC, Nonce Replay, Surface)
├─ TRINITY XDR Virtual Route Isolation (503)
└─ Blackbox Tamper-Evident Flight Recorder
│
▼
[ LAYER 1: SELF-INTEGRITY ENGINE ]
└─ Merkle Root Verification & SHA-256 Manifest Trust Anchor
│
▼
[ LAYERS 2–3: DEEP PACKET & BEHAVIORAL INSPECTION ]
├─ AEGIS Deep Packet Inspection (GET, POST, JSON, Headers, Multipart)
└─ PROMETHEUS Behavioral Threat Scoring & Event Horizon
│
▼
[ LAYERS 4–5: HARDENING & CYBER DECEPTION ]
├─ TITAN System Hardening & Anti-Enumeration
├─ HADES Dynamic Admin Route Cloaking
├─ NEMESIS Deception Grid & Cryptographic Canaries
└─ GHOST TRAP Decoy Routes
│
▼
[ LAYERS 6–7: RUNTIME APPLICATION PROTECTION & EGRESS ]
├─ MORPHEUS RASP (In-Memory DB Mutation & Option Guard)
├─ AIRLOCK Ingress File Sandbox (Entropy, Polyglots, SVG Sanitation)
└─ STYX Outbound Zero-Trust Egress Shield
│
▼
[ WORDPRESS APPLICATION EXECUTION ]
| # | Module | Security Role | Layer / Domain |
|---|---|---|---|
| 1 | ZEUS | Pre-Boot Admission Control & Edge Defense Kernel | Pre-Boot / L0 |
| 2 | AEGIS | Deep Packet Inspection WAF | Ingress / L3-L7 |
| 3 | PROMETHEUS | Behavioral Threat Scoring & Network Horizon | Behavioral / L7 |
| 4 | TRINITY XDR | Autonomous Closed-Loop Response Orchestration | Cross-Layer XDR |
| 5 | SELF-INTEGRITY | Merkle-Based Cryptographic Core Verification | Integrity / L1 |
| 6 | MORPHEUS | Runtime Application Self-Protection (RASP) | Runtime / L7 |
| 7 | NEMESIS | Cyber Deception & Canary Grid | Deception / L7 |
| 8 | TITAN | WordPress Hardening & Web Assurance Lifecycle | Hardening / L4 |
| 9 | HADES | Dynamic Admin Path Cloaking | Identity / L7 |
| 10 | CERBERUS | Fast Perimeter Firewall & Dynamic Edge Rules | Pre-Boot / L0-L1 |
| 11 | AIRLOCK | File Upload & Entropy Inspection Sandbox | Ingress / L7 |
| 12 | GHOST TRAP | Honeypot & Decoy Route Engine | Deception / L7 |
| 13 | STYX | Outbound HTTP / Exfiltration Control Shield | Egress / L7 |
| 14 | CHRONOS | Autonomous Integrity & Filesystem Scanner | Background |
| 15 | KEY VAULT | Cryptographic Secret & Key Storage | Cryptography |
| 16 | ORACLE | Static Security & Posture Audit Engine | Audit |
| 17 | THRONEGUARD | Master/Admin Privilege Separation & Superkey | Identity / Privilege |
| 18 | LOGINPAGER | Local-First Login Surface & Glassmorphism Gateway | Identity / UI |
| 19 | MODULE REGISTRY | Open Core Expansion Hub | Extensibility |
Classification: Layer 0 Pre-Boot Admission Control & Edge Defense Kernel
Core class: VisionGaia\GeDefense\Modules\Zeus\VIS_Zeus
Path: includes/modules/zeus/class-vis-zeus.php
ZEUS runs at the absolute edge of PHP execution via auto_prepend_file before WordPress boots. It determines if a request deserves to allocate memory and load the WordPress runtime.
- Deterministic Canonicalization Guard: Validates request URIs before routing. Neutralizes polyglot traversals, double-encodings, null-bytes, and encoded slashes (
400 Bad Request). - RFC Host Invariant & Host Lock: Validates host envelopes, enforcing strict matching against canonical domain whitelists (
421 Misdirected Request). - Route Contracts Engine: Evaluates micro-firewall policies per route: HTTP methods (
405), body limits (413), content types (415), query limits (414), cross-site mutation policies (403), and route-specific rate budgets (429). - Zero-Allocation Request Budgets: High-speed rate limiting tracking client IPs and
/24(IPv4) //64(IPv6) subnets in APCu or atomic files withTHROTTLE,TEMPORARY_REJECT, orXDR_SIGNALactions. - Cryptographic Admission Tokens: Generates and verifies HMAC-SHA256 tokens (
vgt1.<b64>.<sig>) with surface binding, expiry, and single-use nonce replay protection. - Tamper-Evident Blackbox Flight Recorder: High-speed append-only spool logging with rolling HMAC hash chains, 300s flood coalescing, and boot-time draining into the Event Bus.
- Hardening Lab: Microbenchmark suite measuring sub-microsecond evaluation speeds and a 9-point self-test gate.
Classification: Layer 3/7 Ingress Firewall & Protocol Analyzer
Core class: VisionGaia\GeDefense\Modules\Aegis\Aegis
Path: includes/modules/aegis/class-vis-aegis.php
AEGIS is the deep application-layer inspection engine, analyzing structured parameters, headers, and request bodies.
- SQL Injection: UNION-based, blind, stacked, error-based, and time-based SQLi with comment-collapsing and homoglyph normalization.
- Cross-Site Scripting (XSS): Reflected, stored, tag smuggling, and SVG event handlers.
- Remote Code Execution (RCE): PHP execution constructs (
eval,assert,system,passthru,preg_replace /e). - File Inclusion & Traversal:
php://filter,data://,expect://, LFI/RFI, and phar deserialization. - Recursive Inspection: Deep analysis up to 15 levels into nested JSON, multipart boundaries, and URI parameters.
- Anbindung an Groq
- OSS 20B Safeguard für Sicherheitschecks
- Datenblatt
Classification: Layer 7 Behavioral Analysis & Threat Horizon Engine
Namespace: VisionGaia\GeDefense\Modules\Prometheus\Prometheus
Prometheus aggregates behavioral signals across individual actors and /24 network horizons over sliding time windows.
- Dynamic threat scoring with automatic decay (
0.2 points / second). - Event horizon thresholds escalate suspicious actors into TRINITY containment or Cerberus perimeter drops.
- Correlates distributed scanners, rotating proxy swarms, and aggressive brute-force bots.
Classification: Autonomous Multi-Sensor Response & Extended Detection Fabric
Namespace: VisionGaia\GeDefense\Xdr
TRINITY XDR unifies telemetry from all defensive modules into an automated, closed-loop mitigation engine.
- Two-Way Virtual Route Containment: Isolates compromised plugin routes at Pre-Boot Layer 0 via
Zeus_Xdr_Bridgewithout affecting overall site availability. - Hard Semantic TTLs: Enforces exact expiration timestamps for all mitigations, ensuring temporary bans and route containments expire cleanly without WP-Cron.
- Configurable Presets & Modes: Conservative, Balanced, Aggressive, and Custom TTL configurations with automatic 4x escalation multipliers for repeat offenders.
- Merkle Evidence Root: Cryptographically commits security event evidence chains into tamper-evident digests (
wp_vis_xdr_evidence).
Classification: Layer 1 Cryptographic Invariant Guard
Class: VisionGaia\GeDefense\Core\ModuleIntegrity
Path: includes/core/class-vis-module-integrity.php
The self-integrity engine continuously verifies GeDefense WP core files against an immutable SHA-256 cryptographic trust anchor.
- Constant-time verification (
hash_equals). - Immediate detection of tampered or modified core files.
- Fail-close protection preserving the host environment if core integrity is compromised.
Classification: Layer 7 In-Memory Execution Protection
Namespace: VisionGaia\GeDefense\Modules\Morpheus\Morpheus
Morpheus monitors runtime memory and execution call-stacks during active WordPress execution.
- DML Database Protection: Guards sensitive tables (
wp_users,wp_usermeta) against unauthorized password tampering or privilege elevation. - Critical Option Sentinel: Monitors and protects
siteurl,home, andactive_plugins. - SSRF & Network Jail: Blocks unauthorized outbound requests targeting local or cloud metadata endpoints (
127.0.0.1,169.254.169.254).
Classification: Layer 7 Cyber Deception & Canary Matrix
Namespace: VisionGaia\GeDefense\Modules\Nemesis\Nemesis
Nemesis provides active defensive deception, luring automated scanners away from real application assets.
- Bounded decoy responses for sensitive targets (
.env,wp-config.php.bak,phpmyadmin). - HMAC-backed cryptographic canary tokens for leak tracing.
- Zero worker blocking: no slowloris delays or dangerous terminal payloads.
Classification: Layer 4 System Hardening & Assurance Shield
Class: VisionGaia\GeDefense\Modules\Titan\Titan
Path: includes/modules/titan/class-vis-titan.php
Titan hardens the WordPress attack surface and enforces browser security policies.
- 5-stage assurance lifecycle (
IDLE,ANALYZING,STAGING,ENFORCING,RECOVERED). - Author and REST user enumeration suppression.
- XML-RPC lockdown, file editor restriction (
DISALLOW_FILE_EDIT), and server signature stripping. - HSTS Preload, Origin Sandbox verification, and Secure Fetch Metadata validation.
Classification: Layer 7 Identity & Route Cloaking
Class: VisionGaia\GeDefense\Modules\Hades\Hades
Path: includes/modules/hades/class-vis-hades.php
Hades cloaks the administrative entry point (wp-login.php, wp-admin), returning a 404 response to unauthorized visitors without a valid cryptographic handshake.
Classification: Layer 0/1 Instant Drop Barrier
Class: VisionGaia\GeDefense\Modules\Cerberus\Cerberus
Path: includes/modules/cerberus/class-vis-cerberus.php
Cerberus provides instant perimeter drops for known hostile actors at the earliest stage of execution.
- High-speed memory-cache lookups.
- IPv4 and IPv6 CIDR subnet matching.
- Cloudflare trusted proxy CIDR verification.
- Dynamic OS firewall rule synchronization (Nginx, Apache) reflecting active XDR TTL states.
Classification: Layer 7 Ingress Data Sandbox
Class: VisionGaia\GeDefense\Modules\Airlock\Airlock
Path: includes/modules/airlock/class-vis-airlock.php
Airlock inspects all uploaded files using content-aware heuristics rather than trusting extensions.
- Magic-byte verification and MIME type validation.
- SVG sanitization (neutralizing embedded scripts, event handlers, and XML entity expansion).
- Polyglot file detection and hidden PHP code extraction in image EXIF metadata.
- Entropy analysis for detecting obfuscated shells.
Classification: Layer 7 Active Lure Engine
Class: VisionGaia\GeDefense\Modules\Trap\GhostTrap
Path: includes/modules/trap/class-vis-ghost-trap.php
Ghost Trap injects realistic, hidden lure links and decoy assets (database.dump, backup.sql, .aws/credentials). Any client accessing these routes is instantly flagged as malicious automation.
Classification: Layer 7 Egress Control & Supply-Chain Guard
Class: VisionGaia\GeDefense\Modules\Styx\Styx
Path: includes/modules/styx/class-vis-styx.php
Styx monitors and restricts outbound HTTP requests initiated by WordPress or installed plugins.
- Outbound domain allowlisting.
- Exfiltration protection against compromised plugins.
- Optional suppression of WordPress core telemetry.
Classification: Asynchronous Background Integrity Daemon
Class: VisionGaia\GeDefense\Modules\Chronos\Chronos
Path: includes/modules/chronos/class-vis-chronos.php
Chronos executes scheduled, path-jailed background integrity scans across WordPress core, plugins, themes, and application files.
Classification: Cryptographic Key Management
Class: VisionGaia\GeDefense\Modules\Vault\KeyVault
The Key Vault provides authenticated, encrypted storage (Libsodium Secretbox / AES-256-GCM) for sensitive configuration values and module API keys.
Classification: Static Security & Configuration Auditing
Class: VisionGaia\GeDefense\Modules\Oracle\Oracle
Path: includes/modules/oracle/class-vis-oracle.php
Oracle continuously audits 12 critical vectors of WordPress and PHP security posture, generating actionable hardening scores and diagnostic reports.
Classification: Layer 7 Privilege Boundary & Identity Hardening
Core class: VisionGaia\GeDefense\Modules\ThroneGuard\ThroneGuard (VIS_Throne_Guard)
Path: includes/modules/throneguard/class-vis-throne-guard.php
ThroneGuard establishes an immutable Master tier above standard WordPress administrators, allowing site owners to selectively restrict sensitive administrator capabilities (Plugins, Themes, User Elevation, Filesystem updates) and enforce zero-trust Superkey verification on administrative sessions.
Classification: Authentication Gateway & Visual Hardening
Core class: VisionGaia\GeDefense\Modules\LoginPager\LoginPager (VIS_LoginPager)
Path: includes/modules/loginpager/class-vis-loginpager.php
LoginPager transforms the default WordPress login screen into a zero-dependency, cyberpunk-styled glassmorphism gateway with live interactive preview controls and instant color presets.
Classification: Extensible Module Architecture
Class: VisionGaia\GeDefense\Core\ModuleRegistry
Path: includes/core/class-vis-module-registry.php
The module registry allows GeDefense WP to be seamlessly extended with modular applications such as Vision Legal Pro (VLP), Lightweight Builder, and GEO Architect.
GeDefense WP strictly adheres to a zero-external-dependency architecture:
- PHP 8.1–8.4 strict typing (
declare(strict_types=1);). - Zero Composer runtime packages in the core.
- Zero external CDN dependencies (all assets and icons are locally bundled).
- Native cryptographic APIs (Libsodium / OpenSSL).
| Metric | GeDefense WP 8.1.0 |
|---|---|
| L0 Pre-Boot Evaluation Latency | < 0.05 ms |
| L0 Microbenchmark Throughput | 150,000+ evals/sec |
| WAF Deep Inspection Latency | 0.30 ms |
| Standby RAM Footprint | < 1.8 MB |
| External PHP Dependencies | 0 |
| Control Model | Local / Self-Contained |
The repository contains extensive automated test suites verifying all security invariants:
# Pre-Boot WAF Subprocess Regression Suite (30 tests)
php scripts/zeus-live-waf-regression.php
# Zeus NextGen Comprehensive Regression Suite (10 suites)
php scripts/zeus-nextgen-regression.php
# Trinity XDR Closed-Loop Release Blockers Suite
php scripts/xdr-release-blockers-regression.php
# Full Core Test Suites
php scripts/security-regression.php
php scripts/malware-scanner-regression.php
php scripts/throneguard-loginpager-regression.php
php scripts/aegis-regression.php
php scripts/trinity-regression.php
php scripts/morpheus-regression.php
php scripts/titan-regression.php| Component | Requirement |
|---|---|
| PHP | 8.1–8.4 |
| WordPress | 6.0+ |
| PHP Mode | Strict Types (declare(strict_types=1);) |
| External Libraries | None (100% Zero-Dependency) |
| Libsodium | Recommended for native secretbox encryption |
| Object Cache | Optional; APCu enhances high-throughput L0 rate budgeting |
GeDefense WP Open Core is licensed under the GNU Affero General Public License v3.0 (AGPL-3.0-or-later). See LICENSE for full details.
- Autonomous Multi-Feed Threat Intelligence:
- Implemented 100% Opt-In Threat Intelligence Engine synchronizing verified malicious nodes, botnet C2s, and attacker ranges every 12 hours.
- Aggregates 9 authoritative global threat feeds: Feodo Tracker Botnet C2, Spamhaus DROP IPv4 & IPv6, CINS Army Badguys, blocklist.de All-Attackers, Emerging Threats Compromised IPs, IPsum Threat Intelligence, FireHOL Level 1 Netset, and Tor Bulk Exit Nodes.
- SQLi-Immune Regex & Length Boundary Guard:
- All incoming feed data is strictly filtered through a multi-stage validation pipeline: length boundaries (3–49 chars), strict character whitelist regex (
^[0-9a-fA-F.:\/]+$), and formalfilter_var(..., FILTER_VALIDATE_IP)/ subnet checks. Rejects all SQL tokens, control characters, null bytes, and script tags. - All database upserts executed using chunked batches (500 records/batch) via
$wpdb->prepare().
- All incoming feed data is strictly filtered through a multi-stage validation pipeline: length boundaries (3–49 chars), strict character whitelist regex (
- Styx & Cerberus Interlock:
- Styx (Outbound Egress Shield): Intercepts and blocks outbound HTTP requests from plugins/themes targeting documented C2 and malware nodes.
- Cerberus (Inbound Perimeter): Blocks incoming connections from threat intelligence IPs at the gate with high-tech telemetry.
- Styx Cockpit Management Panel:
- Added "03 / THREAT INTELLIGENCE MATRIX (OPT-IN)" with master toggle, granular feed selection, real-time node counters, and manual 1-click sync action with nonce verification.
- Corporate Landing-Page & Microsite Block Screen:
- Transformed both Cerberus IP bans and Prometheus AI predictive strikes into a full-fledged, professional corporate microsite / landing-page.
- False-positive visitors no longer encounter an intimidating, raw red error screen, but see a recognizable corporate presence with custom logo, custom background artwork with adjustable darkening overlay (30%–98%), company headline, claim, description ("Who we are & what we do"), and core competence / USP feature cards.
- Direct customer support hub: one-tap-to-call mobile button (
tel:), 1-click email button (mailto:) with pre-filled subject including the deterministic incident reference code (PROM-XXXX-XXXX/CERB-XXXX-XXXX), physical address, and business operating hours.
- De-escalating Transparent Security Box ("Darunter"):
- Positioned discreetly beneath the corporate presentation to reassure visitors that customer support can unblock them immediately.
- Real-time incident telemetry: Incident Reference ID, client IP address, UTC timestamp, defense layer (
PROMETHEUS ZERO-TRUST MATRIX // OMEGA PROTOCOL/CERBERUS XDR KERNEL), and security violation reason with a pulsing beacon status indicator. - 1-Click native clipboard copy button with cross-browser fallback: enables users to copy complete incident telemetry with one tap for support triage.
- 100% autarkic, zero external dependencies, zero CDN scripts or fonts, zero database overhead on blocked hits (0.00ms latency).
- Prometheus Zero-Trust High-Tech Termination:
- Replaced legacy plaintext mitigation output (
VISIONGAIATECHNOLOGY OMEGA PROTOCOL: CONNECTION TERMINATED) with high-tech Cerberus block page delegation and standalone fallback.
- Replaced legacy plaintext mitigation output (
- Cerberus Admin Branding Customizer (
view-cerberus.php):- Integrated 4 dedicated configuration cards under
WP-Admin -> GeDefense / Sentinel -> Cerberus -> Block-Page Personalisierung & Brandingcovering visual identity, corporate presentation, contact hub, and custom de-escalation notes. - Instant live preview actions for Cerberus and Prometheus strikes with cryptographic nonce protection.
- Integrated 4 dedicated configuration cards under
- Cryptographic Trust Anchor & Integrity Sync:
- Regenerated Merkle tree root manifest digests across all 27 core components with 100% pass across integrity, security, Trinity, and integration regression suites.
- Cerberus Dual-Mode Unban & Ban Dispatch:
- Resolved fatal error
Non-static method VIS_Cerberus::unban_ip() cannot be called staticallytriggered when unbanning IPs via the Cerberus cockpit (view-cerberus.php). - Refactored
VIS_Cerberus::unban_ip()andVIS_Cerberus::ban_ip()into formal static methods delegating toself::instance(), guaranteeing 100% dual-mode invocation compatibility across PHP 8.0–8.4 (allowing both staticVIS_Cerberus::unban_ip($ip)and instance$cerberus->unban_ip($ip)calls). - Modernized
view-cerberus.phpform handlers to directly invokeVIS_Cerberus::instance()->unban_target($unban_ip)andVIS_Cerberus::instance()->ban_ip($ban_ip, $ban_reason).
- Resolved fatal error
- Cryptographic Trust Anchor & Integrity Sync:
- Regenerated Merkle tree root manifest digests across all 27 core components with 100% pass across integrity, security, and Trinity regression suites.
- Cerberus Perimeter Defense NextGen 403 Forbidden Screen:
- Transformed the plain HTML 403 blocking page into a zero-dependency Cyberpunk / High-Tech Active Mitigation cockpit.
- Implemented real-time telemetry display: Client IP Address, Defense Layer (
CERBERUS XDR KERNEL), UTC mitigation timestamp, security violation reason, and deterministic Incident Reference code (CERB-XXXX-XXXX) for streamlined false-positive verification and support triage. - Hardened perimeter defense response headers: protocol reflection (
403 Forbidden),X-Robots-Tag: noindex, nofollow, nosnippetto eliminate search engine caching,X-Content-Type-Options: nosniff,X-Frame-Options: DENY(anti-clickjacking),Cache-Control: private, max-age=300, andX-Defense-Engine: VisionGaia-Cerberus. - Maintained strict Zero-Dependency & Zero-Overhead standard: 100% self-contained HTML5 template with inline SVG vectors, CSS pulse animations, and native monospace font stack fallbacks (
JetBrains Mono,Fira Code,SF Mono,Consolas,monospace). No external CDN assets, no external scripts, and 0 database queries on fail-early rejection paths.
- Cryptographic Trust Anchor & Integrity Sync:
- Regenerated Merkle tree root manifest digests across all 27 core components (
digest=88a6614a31d1faeb6220cdecc867410727713e8399f42fcf795dcaedbcaa85a9) with 100% pass across integrity and security regression suites.
- Regenerated Merkle tree root manifest digests across all 27 core components (
- Early-Bootstrap Pluggable Decoupling (
AEGIS_KERNEL&VAULT):- Eliminated fatal panic
Call to undefined function wp_parse_auth_cookie()andis_user_logged_in()during early Phase 1 bootstrap. - Implemented zero-dependency session token extraction directly from canonical
wordpress_logged_in_*auth cookies with HMAC-SHA256 signature verification and transient validation. - Guarded all runtime invocations of
wp_get_session_token(),get_current_user_id(),wp_get_current_user(), andwp_validate_auth_cookie()with strictfunction_exists('wp_parse_auth_cookie')pre-flight guards and\Throwableisolation to prevent 503 Fail-Close lockouts during page builder saves and live previews.
- Eliminated fatal panic
- Bootstrapper Diagnostic Transparency:
- Enhanced
VIS_Bootstrapper::trigger_fail_close()with explicit logging of root-cause exception messages, source files, and line numbers to the WordPress debug log, preventing silent error swallowing.
- Enhanced
- TITAN Admin Autosave Stability:
- Conditioned
wp_deregister_script('heartbeat')insideif (!is_admin())to prevent WordPress 6.xWP_Scripts::addPHP notices and ensure reliable autosave execution in admin and builder viewports.
- Conditioned
- Privacy Shield (VLP) ReDoS & Buffer Hardening:
- Refactored
VLP_Privacy_Gatekeeper::process_html()regex parsing engine ($tag_pattern,$link_pattern) with non-backtracking atomic groups(?>[^>"\']+|"[^"]*"|\'[^\']*\')*, preventing catastrophic ReDoS and PCRE backtrack exhaustion on large HTML payloads. - Implemented defensive buffer handling ensuring output buffers are never clobbered with
nullwhen flushes occur.
- Refactored
- Malware Scanner Lexical Detector Hardening:
- De-risked detection string signatures in
VIS_Php_Lexical_Detectorto eliminate local host antivirus / Windows Defender false-positive file-lock conditions while preserving full webshell detection capabilities.
- De-risked detection string signatures in
- Cryptographic Trust Anchor & Integrity Sync:
- Regenerated Merkle tree root manifest digests across all 27 core components (
digest=b96b6dbca440a8d64a0e6b6fb9fa6a47e236c2a4d88bfc68ac383e9414b27812) with 100% pass across integrity, security, and Trinity regression suites.
- Regenerated Merkle tree root manifest digests across all 27 core components (
- ZEUS Next Generation: Layer 0 pre-boot admission kernel with deterministic canonicalization, RFC host lock, route contracts, token-bucket rate limiter, and cryptographic admission tokens.
- TRINITY Autonomous Closed-Loop XDR: Two-way virtual route containment, hard semantic TTL engine, multi-sensor response actuators (Cerberus, Zeus Route, Zeus Admission, Morpheus, Styx, Plugin Isolation), and Merkle evidence root.
- Next-Gen Cyber-Defense Dashboard: Complete UI/UX refactoring, Security Center Assurance Plane with 21 deep checks, NOC topology visualizer, live sensor telemetry grid, and universal save pipeline.
- 100% 3-Language Localization (DE, RU, EN): Over 1,100 translated strings with dynamic client-side
#vsc-i18nJavaScript bridge. - Official Documentation: Complete
ARCHITECTURE.mdspecification and 3 official PDF handbooks (German, Russian, English). (See detailed changelog at top of README)
- Sovereign Master Role (
master) and Granular Admin Capability Matrix in ThroneGuard. - Zero-Trust Superkey Vault and Lockscreen Overlay.
- Cyberpunk LoginPager with live 2-column cockpit simulator.
- 100% 3-Language Localization Matrix (DE, EN, RU).
- Resumable indexing and accepted-baseline stability in Integrity Monitor.
- Persistent admin-IP protection gate.
- Dedicated Trinity orchestration core for deterministic AEGIS, Prometheus, and Cerberus routing.
- Zero-dependency malware kernel shared by Airlock and Chronos.