"No external libraries. No blind trust. No compromise." AGPLv3 — Open Source Core. Built for humans, not for SaaS margins.
This project is a Proof of Concept (PoC) and part of ongoing research and development at VisionGaia Technology. It is not a certified or production-ready product.
Use at your own risk. The software may contain security vulnerabilities, bugs, or unexpected behavior. It may break your environment if misconfigured or used improperly.
Do not deploy in critical production environments unless you have thoroughly audited the code and understand the implications. For enterprise-grade, verified protection, we recommend established and officially certified solutions.
Found a vulnerability or have an improvement? Open an issue or contact us.
- New Regex Filters
- Red team tests for internal use to evaluate Sentinel VGT Sentinel
- We work every day to improve the Community Edition.
VGT Sentinel Community Edition is a modular, zero-dependency WordPress security framework engineered to neutralize deterministic attack vectors without sacrificing performance.
It is the open-source core of the VGT Sentinel suite — a battle-hardened, multi-layered defense system built on a Zero-Trust architecture. Every request is inspected, every header hardened, every upload analyzed, every file hashed.
Traditional WordPress Security:
→ Single plugin = single point of failure
→ Shared hosting overhead
→ No outbound control
→ No filesystem integrity monitoring
VGT Sentinel ZTNA Security Stack:
→ Stream-based WAF (AEGIS) — SQLi, XSS, RCE, LFI neutralized
→ Kernel Hardening (TITAN) — Server fingerprint masked
→ Stealth Engine (HADES) — WordPress architecture obfuscated
→ Access Guard (CERBERUS) — IP-validated brute-force prevention
→ Outbound Control (STYX LITE) — Data exfiltration blocked
→ Payload Sanitizer (AIRLOCK) — Binary upload inspection
→ Integrity Monitor (CHRONOS) — SHA-256 filesystem diff-hashing
Incoming HTTP Request
↓
CERBERUS (Pre-Auth IP Validation)
→ Cloudflare CIDR verification
→ X-Forwarded-For spoofing prevention
→ Brute-force state via RAM/Object Cache
→ Hook Priority 1 — fires before WP user logic
↓
AEGIS WAF (Stream Inspection)
→ php://input scanned in 4KB binary chunks
→ Overlap-buffer for boundary-spanning patterns
→ 512KB scan limit (Memory Exhaustion prevention)
→ Tarpit: Socket-Drop + Connection: Close on critical hit
↓
TITAN (Kernel Hardening)
→ Security headers injected
→ X-Powered-By camouflage (Laravel / Drupal / Django)
→ XML-RPC blocked, REST API locked to auth sessions
→ .env / wp-config.php / .git access denied at .htaccess level
↓
HADES (Stealth Engine)
→ URL rewrites mask WordPress directory structure
→ Custom slugs for wp-admin and wp-login.php
↓
AIRLOCK (Upload Inspection)
→ Magic Byte analysis on 4KB header/footer chunks
→ PHP wrapper, Base64 and exec-pattern detection
→ Polyglot file prevention
↓
CHRONOS (Async Integrity Monitor)
→ SHA-256 against integrity_matrix.php baseline
→ mtime + size pre-filter before hash computation
→ Ghost Trap honeypot triggers IP blacklisting on access
→ Cron-sliced execution (max 20s) — PHP timeout safe
↓
STYX LITE (Outbound Control)
→ Telemetry Kill Switch for api.wordpress.org
→ Supply-chain exfiltration blocked
Stream-based WAF for real-time payload inspection.
| Parameter | Value |
|---|---|
| Engine | Deterministic Regex Pattern Matching |
| Scan Limit | 512 KB (Memory Exhaustion prevention) |
| Read Strategy | php://input binary stream in 4KB chunks with overlap buffer |
| Protected Vectors | SQLi, XSS, RCE, LFI, Malicious User Agents |
| Threat Response | Immediate socket-drop (Connection: Close) before header send |
Application-layer hardening and server signature masking.
Headers Enforced:
→ X-XSS-Protection
→ X-Frame-Options: SAMEORIGIN
→ X-Content-Type-Options: nosniff
→ Referrer-Policy
→ Permissions-Policy
Camouflage Engine:
→ X-Powered-By spoofed to: Laravel | Drupal | Django
API Lockdown:
→ XML-RPC: BLOCKED (full)
→ REST API: Auth-only sessions
→ RSS/Atom: DISABLED
Protected Paths (.htaccess):
→ .env | .git | wp-config.php | composer.json | Vault directories
Architecture obfuscation to prevent automated WordPress fingerprinting.
URL Rewrite Map:
| Original Path | Masked Path |
|---|---|
wp-content/themes |
content/ui |
wp-content/plugins |
content/lib |
wp-content/uploads |
storage |
wp-includes |
core |
wp-admin |
(Custom Slug) |
wp-login.php |
(Custom Slug) |
Webserver Support: Apache (auto via .htaccess) · Nginx (static rule injection) · LiteSpeed
Pre-authentication IP validation and brute-force defense.
| Feature | Detail |
|---|---|
| True-IP Detection | Native Cloudflare CIDR validation — prevents X-Forwarded-For spoofing |
| Fail-State Tracking | RAM/Object Cache via WordPress Transients |
| Hook Priority | 1 on authenticate — fires before any WP user logic loads |
Network-layer control against data exfiltration and supply-chain attacks.
Telemetry Kill Switch — Blocked Domains:
→ api.wordpress.org
→ downloads.wordpress.org
→ s.w.org
Supply-Chain Protection:
→ Blocks unintended external communication from compromised plugins
Binary-level analysis of all file uploads (multipart/form-data).
| Feature | Detail |
|---|---|
| File Policy | Strict allowlist — only pre-approved safe formats |
| Large File Strategy | Memory-safe chunked read — 4KB header/footer scan for files >2MB |
| Magic Byte Inspection | Detects real file type regardless of extension |
| Polyglot Prevention | Blocks PHP wrappers, Base64 obfuscation, exec-patterns in image/document payloads |
Asynchronous filesystem integrity monitoring with honeypot tripwire.
Differential Hashing:
→ SHA-256 verified against integrity_matrix.php (PHP-formatted — prevents web exposure)
→ mtime + size pre-filter: hash only runs when metadata changes
Ghost Trap:
→ Honeypot file: wp-admin-backup-restore.php
→ HTTP access = immediate IP blacklisting
Execution Safety:
→ Async State Machine — max 20s Cron-Slice
→ No PHP timeout risk on large installations
Zero performance tax. Maximum coverage.
| Optimization | Mechanism |
|---|---|
| Fast-Path Routing | Static assets bypass WAF inspection entirely — saves >90% CPU cycles |
| Stream Chunking | Payload inspection via chunked reads — low, stable RAM footprint |
| Async Scheduling | CHRONOS runs in time-sliced cron — never blocks request handling |
| Zero Dependencies | No external libraries — no supply chain risk, no overhead |
| Component | Detail |
|---|---|
| PHP | 7.4+ (Recommended: 8.1+) |
| Webserver | Apache (auto), Nginx (manual rule injection), LiteSpeed |
| Page Builders | Bridge Manager auto-disables conflicting DOM/header interventions for Elementor, Divi, Oxygen |
| VGT Ecosystem | Native VisionLegalPro support via Shadow-Net Asset Routing |
| VGT Myrmidon | AEGIS Co-op Mode — whitelists Myrmidon ZTNA API endpoints automatically |
DISCLAIMER: The Community Edition (Silber Status) operates on a deterministic rule engine. It provides a robust shield against standardized, automated botnets, scrapers, and known attack vectors.
The following capabilities are exclusive to VGT Sentinel Pro / Platin Status:
| Capability | Silber | Platin |
|---|---|---|
| ORACLE AI — Polymorphic Zero-Day Detection | ❌ | ✅ |
| PROMETHEUS — Dynamic Behavioral Profiling | ❌ | ✅ |
| NEMESIS — Deception-Engine | ❌ | ✅ |
ZEUS — Pre-Boot WAF via auto_prepend_file) |
❌ | ✅ |
| MORPHEUS — Hypervisor for Plugins | ❌ | ✅ |
| GORGON — Global Swarm Intelligence Threat Feed | ❌ | ✅ |
| API CRYPTO VAULT — AES-256-GCM Database Payload Encryption | ❌ | ✅ |
| Deterministic WAF (AEGIS Lite) | ✅ | ✅ |
| Kernel Hardening (TITAN Lite) | ✅ | ✅ |
| Stealth Engine (HADES Lite) | ✅ | ✅ |
| Access Guard (CERBERUS) | ✅ | ✅ |
| Outbound Control (STYX LITE) | ✅ | ✅ |
| Payload Sanitizer (AIRLOCK Lite) | ✅ | ✅ |
| Integrity Monitor (CHRONOS) | ✅ | ✅ |
# 1. Clone into WordPress plugins directory
cd /var/www/html/wp-content/plugins/
git clone [https://github.com/visiongaiatechnology/vgt-sentinel](https://github.com/visiongaiatechnology/sentinelcom)
# 2. Activate in WordPress Admin
# Plugins → VGT Sentinel Community Edition → Activate
# 3. HADES: Configure custom login slug
# Settings → Sentinel → Stealth Engine
# 4. CHRONOS: Generate initial integrity manifest
# Settings → Sentinel → Integrity Monitor → Generate BaselineOn first activation, Sentinel automatically:
→ Injects AEGIS WAF into the request lifecycle
→ Applies TITAN security headers
→ Activates HADES URL rewrites (.htaccess / Nginx rules)
→ Initializes CERBERUS fail-state cache
→ Generates CHRONOS integrity_matrix.php baseline
→ Deploys Ghost Trap honeypot
→ Activates STYX outbound kill switch
| Tool | Type | Purpose |
|---|---|---|
| ⚔️ VGT Sentinel | WAF / IDS Framework | Zero-Trust WordPress security suite — you are here |
| 🛡️ VGT Myrmidon | ZTNA | Zero Trust device registry and cryptographic integrity verification |
| ⚡ VGT Auto-Punisher | IDS | L4+L7 Hybrid IDS — attackers terminated before they even knock |
| 📊 VGT Dattrack | Analytics | Sovereign analytics engine — your data, your server, no third parties |
| 🌐 VGT Global Threat Sync | Preventive | Daily threat feed — block known attackers before they arrive |
| 🔥 VGT Windows Firewall Burner | Windows | 280,000+ APT IPs in native Windows Firewall |
| Method | Address |
|---|---|
| PayPal | paypal.me/dergoldenelotus |
| Bitcoin | bc1q3ue5gq822tddmkdrek79adlkm36fatat3lz0dm |
| ETH | 0xD37DEfb09e07bD775EaaE9ccDaFE3a5b2348Fe85 |
| USDT (ERC-20) | 0xD37DEfb09e07bD775EaaE9ccDaFE3a5b2348Fe85 |
Pull requests are welcome. For major changes, open an issue first.
Licensed under AGPLv3 — "For Humans, not for SaaS Corporations."
VisionGaia Technology builds enterprise-grade security infrastructure — engineered to the DIAMANT VGT SUPREME standard.
"Sentinel was built because WordPress deserved a security framework that doesn't phone home, doesn't bloat your stack, and doesn't ask you to trust a SaaS dashboard with your attack surface."
Version 1.0.0 — VGT Sentinel Community Edition // Zero-Trust WAF Framework // Deterministic DFA Engine // AGPLv3