How FrothIQ protects your site
A plain-language walkthrough of how FrothIQ decides what to block and how your data is handled.
The 30-second version
FrothIQ runs as a lightweight agent on your WordPress site. Every request to your site is scored in real time against continuously-updated threat intelligence. High-confidence threats are blocked; suspicious-but-not-certain traffic is handled according to the mode you’ve picked (Monitor, Protect, or Block). Everything FrothIQ does is logged, and blocking decisions can be pushed out to layers below WordPress so attackers never consume your PHP resources.
The pieces involved
The edge agent
A WordPress plugin you install on each site. It sees every request, evaluates it against local policy + cached threat intel, and enforces the decision immediately. It communicates with FrothIQ’s intelligence service for updates.
The intelligence service
The brains. Aggregates threat signals across every FrothIQ-protected site, maintains reputation lists, publishes updates to edge agents, and feeds the dashboard.
The dashboard
Where you live. See every site you protect, review attacks, tune policies, manage licenses. Available to operators after you’ve registered with FrothIQ.
How a request flows through FrothIQ
Request arrives
A visitor (or attacker, or bot) makes an HTTP request to your WordPress site. FrothIQ’s edge agent intercepts it before any plugin, theme, or user-facing code runs.
The request gets a score
FrothIQ checks the requester’s IP reputation, the request path, the User-Agent, the HTTP method, timing signals, and pattern matches. A numeric threat score comes out the other side.
Policy decides the action
Based on the score and your current mode, FrothIQ either allows the request, returns a deny response, or escalates to a layer below WordPress so the requester is dropped before PHP runs at all.
Everything is logged
The decision, score, rule that fired, path, and outcome are written to FrothIQ’s local activity log. Masked IPs appear in the UI; full IPs stay in your server error log.
Learnings propagate
High-confidence blocks on one site become intelligence updates for every other site on your tenant — so attackers who probe one of your sites find every other one is waiting for them.
What FrothIQ doesn’t do
Clarity about the scope keeps expectations honest.
- FrothIQ does not replace backups — if your site is compromised despite protection, you still need recovery tooling
- FrothIQ does not replace malware scanning — it focuses on traffic, not on files already on disk
- FrothIQ does not replace hardening — strong passwords, 2FA, minimal plugins, and good hosting still matter
- FrothIQ does not send your user data anywhere — only anonymized threat signals leave your site
Data handling & privacy
FrothIQ is designed so that defending your site doesn’t leak your visitors’ data:
- Only attack-related signals (threat scores, request paths, outcomes) leave your site
- Full IP addresses stay on your server — partial masks are the only thing shown in the UI
- No user-supplied content (form data, cookies, credentials) is ever transmitted off-site
- All FrothIQ communication is encrypted in transit
- See the Privacy Policy for the full data lifecycle
Install it and see
Reading about a security product only gets you so far. Put it on a site, flip to Monitor, and watch the attacks the internet throws at you every hour.