Security actions contained
Recorded protection actions that contained request or commerce pressure.
CONTAINED
Nexus Threat Network
Real security activity. Real containment.
Privacy-preserving aggregate telemetry from active Nexus PRO protection. These counters reflect recorded security activity—not simulated dashboard numbers.
LIVE AGGREGATE
Updated 10 min ago
SHARED INTELLIGENCE · LOCAL DECISIONS
Network evidence adds context. Each site keeps the final protection decision local.
No public site list, raw IP feed or customer activity is exposed through this Pulse.
Threat Network + Nexus Intelligence
Explore Nexus Intelligence →Shared activity shows the pressure. Shared intelligence helps recognize the behavior.
The public Pulse reports privacy-preserving aggregate security activity. Nexus Intelligence separately provides bounded attack-pattern context to participating licensed sites, while every final decision remains local.
THREAT NETWORK PULSELIVE AGGREGATE
HEADLINE WINDOWLast 30 days
DATA MODELAggregate only
SIMULATED COUNTERSNone
REFRESHUpdated 10 min ago
Verified activity
What Nexus protection has actually recorded.
Headline totals use last 30 days while the live charts remain rolling 24-hour views. Containment and observation stay separate.
Stopped before WordPress
Requests rejected by early protection before normal WordPress execution.
EARLY BLOCKWooCommerce pressure contained
Commerce-specific pressure or automated actions contained by Nexus.
COMMERCE DEFENSECredential pressure observed
Meaningful distributed or repeated login-pressure signals. Ordinary mistyped passwords are not counted.
Login Guard restrictions
Temporary login restrictions or lockouts actually enforced by Nexus.
Reconnaissance signals observed
Security-relevant probing, enumeration and reconnaissance observations.
XML-RPC restrictions
XML-RPC pressure or abuse restricted by Nexus protection layers.
24-hour containment
Protection activity over time.
Bars are real hourly aggregate counts. The red-lit peaks mark the busiest containment windows—not a different metric.
24 hours agoNow
24-hour signal lanes
Where is Nexus seeing pressure—and where is it acting?
Independent counts, scaled against the highest lane. These categories can overlap and are not percentages of one whole.
Early defense1,257
WooCommerce pressure1,218
Credential pressure observed131
Login Guard restrictions38
Reconnaissance observed19.5K
XML-RPC restrictions224
Observation layer
Reconnaissance over time.
Observed probing remains visually separate from containment. Credential pressure and reconnaissance do not become block counts unless Nexus actually enforces a restriction.
24 hours agoNow
30-day verified trend
Daily contained security activity.
One UTC bar per day across the last 30 days. Peak days are highlighted without changing the metric.
30 days agoToday
↓ 61.9% vs previous 30 days
Verified period context
24-hour activity stays live and precise. Longer headline totals grow only from real daily telemetry, with 30-day comparison enabled after enough history exists.
24H CONTAINMENT4,548
7-DAY CONTAINMENT65.6K
LAST 30 DAYS · CONTAINED223.7K
LAST 30 DAYS · EARLY BLOCKS13.5K
LAST 30 DAYS · WOO PRESSURE13K
VS PREVIOUS 30 DAYS↓ 61.9% vs previous 30 days
How to read the Pulse
Action, observation and early containment are different things.
The page is deliberately strict about language. A large number is useful only when the label still describes what Nexus actually recorded.
Contained
Nexus actively restricted or neutralized activity. Red accents are reserved for real containment and high-pressure moments.
Stopped before WordPress
The request was rejected by an early protection layer before normal WordPress execution, reducing avoidable application work.
Observed
Reconnaissance and credential pressure that Nexus recorded as security-relevant. Observation does not automatically mean correlation, compromise or enforcement.
Privacy-preserving by design
Security counts travel. Customer activity does not.
Nexus PRO contributes compact aggregate security telemetry in background batches. The public Pulse receives only sanitized totals prepared by the Controller.
- No customer content or order data
- No usernames, cookies or request bodies
- No public domains, site IDs or reporting-installation count
- No public raw IP or per-site activity feed
01Nexus PROLocal security activity
→
02ControllerValidate & aggregate
→
03Static snapshotSanitized totals
→
04Public PulseCached presentation
Threat Network
Shared intelligence without surrendered control.
Participating Nexus installations contribute carefully selected security evidence and receive fresh network intelligence while enforcement remains local to each protected site.
Independent contributor context
Network observations are evaluated with contributor independence and freshness rather than treating raw report volume as consensus.
Asynchronous delivery
Qualifying evidence and aggregate telemetry are delivered outside visitor requests, with retry and back-pressure behavior designed to avoid slowing protected websites.
Local final verdict
Downloaded intelligence adds context to local Nexus decisions. A temporary network-service outage does not turn the cloud into a synchronous dependency.
Nexus PRO
Protect locally. Learn collectively.
Threat Network intelligence is included with an active Nexus PRO licence.