Registered Logo KeideaCMS

Security at the core of the CMS

Enterprise CMS Security: firewall, 2FA and encrypted data already built into KeideaCMS

The firewall checks every request before it reaches the site, form data is encrypted with AES-256, every uploaded file goes through six checks, and the panel opens with 2FA. No security plugins to install and remember to update.

Request a security audit Compare with WordPress

Free analysis of the site you have today

What the firewall blocks, before it reaches the site

KeFirewall runs on your server, inside the CMS: it checks every parameter, every header and the body of every request, with over 90 rules.

SQL Injection

Attempts to read or modify the database: UNION SELECT, chained queries, blind and time-based attacks such as SLEEP and BENCHMARK.

Cross-Site Scripting (XSS)

JavaScript code injected into pages: script tags, event handlers, SVG, data URIs and vbscript.

Local File Inclusion (LFI)

Access to system files: directory traversal, null bytes, PHP wrappers such as php://filter and sensitive files such as /etc/passwd.

Remote File Inclusion (RFI)

Malicious files uploaded from remote servers: injected addresses, data URIs, inclusions from external IPs.

Command Injection and SSRF

Commands launched on the server and forged requests to internal services.

Attacks hidden in Base64

Encoded content is decoded across multiple levels, to expose the attack hidden inside.

Your customers' data, unreadable even to those who steal the database

Name, email, phone number and message from forms are encrypted before being saved. It happens automatically,

  • AES-256-CBC

    The standard used by banks and governments, with a 256-bit key.

  • A different IV every time

    Each encryption uses a random 16-byte vector: the same data encrypted twice won't look alike.

  • Key outside the database

    The key lives in the server settings: a copy of the database remains unreadable.

  • Automatic encryption

    It's not an option to switch on: it applies to every form on the site, always.

How much would a data breach cost you?

Calculate your site's economic exposure in 10 seconds.

10010.00025.00050.000
Sanzione minima stimata —
Costo notifica obbligatoria —
Downtime stimato (72 ore) —
Totale esposizione a rischio —
—
Request your free security audit

Six checks on every uploaded file

A .jpg image can hide PHP code, a PDF can disguise a webshell: that's why the CMS looks inside the file, not just at the extension.

The file name

Null bytes, double extensions, control characters and dangerous extensions like php, phtml, phar, exe and svg are rejected.

Hidden PHP code

Looks for PHP tags and dangerous functions like eval, system and exec inside files that shouldn't contain them.

Known webshells

Recognizes the signatures of the most common webshells, the programs an attacker uses to control the server.

What is a webshell

Polyglot files

Detects files that look like real images but hide code: the most cunning technique.

Shannon entropy

A file encrypted or compressed to hide code shows unusual disorder: above the threshold of 7.2 it is blocked.

Hidden Base64

Searches for and decodes Base64 blocks inside the file to unmask obfuscated code.

Panel access, proof against stolen passwords

A guessed or stolen password isn’t enough to get in.

The KeideaCMS control panel

  • 2FA with the app

    Time-based code (TOTP, RFC 6238) from Google Authenticator, Authy or any compatible app, with limited attempts.

  • Trusted devices

    The office computer can stay trusted for 30 days, with a secure cookie and only its fingerprint stored in the database.

  • Protected sessions

    Cookies invisible to JavaScript and HTTPS-only, CSRF tokens on every form; if you change your password, the other sessions are closed.

  • Per-person permissions

    Each operator sees and manages only the functions they need, and every access is logged.

KeideaCMS vs WordPress: security comparison

What's already included and what you need to add with plugins.

Feature WordPress KeideaCMS
Application firewall (WAF) ✗ Requires a plugin (Wordfence, Sucuri) ✓ Built into the core
SQL injection and XSS ~ Only with up-to-date plugins ✓ Native rules in the firewall
Form data ✗ Usually in plain text in the database ✓ Encrypted with AES-256-CBC
2FA for the panel ✗ Requires a plugin ✓ Built-in TOTP
Uploaded file checks ~ Type and extension ✓ Six content checks
Automatic IP blocking ✗ Requires a plugin or external service ✓ Blacklisted after 5 attacks
Country-based blocking ✗ Paid plugin ✓ Built-in
Attack alerts ~ With plugins ✓ Automatic emails
Public vulnerabilities ✗ Thousands every year in plugins ✓ None published

Security, GDPR and NIS2: what the CMS does and what's up to you

GDPR Article 32 requires adequate technical measures to protect personal data, and the NIS2 directive extends the obligation to manage cyber risk to many more companies. A CMS alone doesn't make you compliant, but it can take care of the most delicate technical part.

The technical measures already built into KeideaCMS

  • Encryption of data at rest: form data is encrypted with AES-256-CBC, with the key stored outside the database.
  • Access control: 2FA for operators, per-person permissions, sessions closed when the password changes.
  • Access and attack log: every access and every blocked attack is logged with date, IP address and reason, for as long as you decide.
  • Incident management: email alerts when an attack is blocked and automatic blacklisting of addresses that keep trying.
  • Country blocking: you can close the site to traffic from countries you don't operate in.

Why a firewall in the core and not a plugin

A security plugin is just another piece to update, which can conflict with others or fall behind. In the core, the firewall checks the request before it reaches the rest of the site and is updated together with the CMS. We talk about this in Application WAF: what it is and why Wordfence isn't enough and in webshell: what it is and how to block it.

The part that remains up to people

Passwords, procedures, suppliers, training: compliance also concerns the organisation. That's why, besides the CMS, we offer ISO 27001 and GDPR consulting. To see everything live, book a free demo, or read how KeideaCMS works and the comparison with other CMS.

Security Insights

Request your free security audit

We tell you what an attacker would see on your site today, whether it's WordPress, Joomla or PrestaShop, and how to shut it down.

A check of the site you have today
What to fix, explained clearly
Free, no obligation

Request information with no obligation

Tell us about yourself and your idea. We analyze your company and guide you step by step in choosing the service that best suits your needs.

Frequently Asked Questions

Yes, by design. WordPress entrusts security to third-party plugins, and the plugin ecosystem publishes thousands of vulnerabilities every year. KeideaCMS has at its core a firewall with over 90 rules against attacks, AES-256-CBC encryption of form data, 2FA for the panel and six checks on every uploaded file: these aren't components to install, they're already there and update together with the CMS.
Every piece of data entered into the site's forms is encrypted with AES-256-CBC before being saved to the database. Each encryption uses a random 16-byte initialization vector, so the same data encrypted twice doesn't look alike. The key is stored in the server settings, not in the database: a stolen copy of the database remains unreadable.
The CMS provides the technical measures required by GDPR (art. 32) and NIS2: encrypted personal data, country blocking, an access and attack log with configurable retention, 2FA for operators and email alerts when an attack is blocked. However, compliance also involves processes and people: that's why we offer ISO 27001 and GDPR consulting.
The request is blocked with a 403 response (or with a captcha check, if you've enabled it) and the event is recorded in the log with threat type, IP, address and user agent. If the same IP attacks 5 times in an hour it gets blacklisted for 24 hours, and the threshold can be changed. The administrator receives an email alert.
No. Firewall, encryption, 2FA and file checking are built into the core of KeideaCMS. If you want, the site can also sit behind Cloudflare: the firewall reads the visitor's real address.
Yes. We analyze the site you have today, even WordPress, Joomla or PrestaShop, and tell you what to fix. For processes and regulations there's the ISO 27001 and GDPR consulting.

Everythingin a singleSoftware

Talk to us for real

Our phone support is available every day from 09:00 to 18:00

+39 0835 239 514 Call us

Not your usual Web Agency

We follow you and always meet you halfway, even on spreading out your investment

Our projects

Need help

For information, quotes, or support, write to us

info@keideacms.it