Understanding the Shield Database Tables

Shield uses a number of MySQL Database tables to manage all the features of the plugin, at the time of writing these are called:

  • wp_icwp_wpsf_ips (IP Addresses)
  • wp_icwp_wpsf_ip_meta (IP Address Meta Data) (depends on ips )
  • wp_icwp_wpsf_ip_rules (IP Rules) (depends on ips )
  • wp_icwp_wpsf_botsignal (IP Bot Signals) (depends on ips )
  • wp_icwp_wpsf_crowdsec_signals (CrowdSec Signals)

  • wp_icwp_wpsf_req_logs (Request/Traffic Logs) (depends on ips )
  • wp_icwp_wpsf_at_logs (Activity Logs) (depends on req_logs )
  • wp_icwp_wpsf_at_meta (Activity Logs Meta) (depends on at_logs )
  • wp_icwp_wpsf_snapshots (Activity Snapshots)

  • wp_icwp_wpsf_scans (Scans)
  • wp_icwp_wpsf_scanitems (Scan Items) (depends on scans )
  • wp_icwp_wpsf_scanresults (Scan Results Sets) (depends on scans )
  • wp_icwp_wpsf_resultitems (Scan Results Items) (depends on scans )
  • wp_icwp_wpsf_resultitem_meta (Scan Results Item Meta Data) (depends on resultitems )
  • wp_icwp_wpsf_malware (Malware entries)
  • wp_icwp_wpsf_file_locker (File Locker)

  • wp_icwp_wpsf_rules (Security Rules)
  • wp_icwp_wpsf_event (Events)
  • wp_icwp_wpsf_user_meta (User Meta Data)
  • wp_icwp_wpsf_mfa (2FA registrations)
  • wp_icwp_wpsf_reports (Reports)

Important: New tables may be added, or tables may be removed. This is not a live list of tables and we'll do our best to keep it up-to-date.

That's around 20 tables. This does not slow your site. You could have a 1000 additional tables and it won't slow your site.

Tables Linked By Foreign Keys

We also use foreign keys to link some tables together, to reduce data duplication. For example, the table: "ips" is a store of all the IP addresses used on the site. It is linked to from the traffic requests (req_logs ), activity log (at_logs ), ip rules (ip_rules ), bot signals (botsignal ) tables.

The tables that deal with scans and scan results (scans , scanresults , scanitems , resultitems and resultitem_meta ) are all also interlinked.

This means that if, for any reason, you want to delete a table, you may not be permitted to do so unless you also delete the linked tables.

How-To: Delete all the traffic logs

There's no way to do this from within the plugin, but if you wanted to delete all the traffic logs, you could simply truncate the traffic log table: req_logs

Bear in mind that the Activity Logs table is linked to the request logs and so when you delete any entry in the traffic log table, the corresponding Activity Log that is linked to it will also be deleted.

How-To: Delete all the Activity Logs

Just as with the traffic logs, you can delete the Activity Logs, too. Simply truncate the at_logs table. Corresponding activity log meta entries in the at_meta table will also be deleted as they are linked.

Deleting Tables

Shield will cache the state of its Database tables so that it doesn't need to check it on every WP page load. If you delete the tables directly on the database, the Shield plugin will not know about that and when you load WordPress you'll start seeing PHP errors relating to the fact that Shield is attempting MySQL queries on tables that don't exist. This cache is around 60 seconds, so you can expect the see the log errors disappear as Shield catches up.