NHR Secure – Security, Firewall, 2FA, Login Protection & Activity Log

Users & Sessions

• Every user with their role, two-factor status, last sign-in and active sessions.
• Sign out one user or everyone else, reset a user’s two-factor, and automatically sign out idle users who can work in the dashboard (customers and subscribers are left alone).
• Password expiry for administrators and editors, and “require a new password” for one user, a role or everyone.
• Session limit. At most the number of sessions you choose per user; the oldest one is ended, so a lost device cannot keep its owner out.
• Temporary access. Give an account an end date, for support staff or a contractor. After it the account cannot sign in and its sessions end; nothing is deleted.

Firewall

• Address rules for IPv4 and IPv6, single addresses or ranges. Allowed addresses skip every rule and are never locked out. Paste a whole list at once, or copy your rules as a list.
• Request filter for probing requests: path traversal, hunts for config and backup files, and SQL or script fragments in the address. It starts in log-only mode so you can see what it would refuse, and any match can be allowed with one click. It checks the address of visitors who are not signed in; checking submitted forms is optional and limited to rules that normal writing cannot trigger.
• Probe lockout. An address that keeps asking for files that do not exist ( .php , .env , backups) is locked out of the public site; the sign-in form stays reachable. Broken links, missing images and requests triggered from other websites do not count.
• Rate limiting for the sign-in page, XML-RPC, the REST API, search and the comment form, per address and minute, for visitors who are not signed in. It needs a persistent object cache (Redis or Memcached), because counting every request in the database would add the load it is meant to remove.
• Country rule for the sign-in page or the whole site (when your site is behind Cloudflare) and user-agent rules .

Hardening

• Turn off XML-RPC, the theme and plugin file editor, application passwords and RSS/Atom feeds; hide usernames from visitors, the WordPress and PHP versions and the discovery links in the page head; send security headers; limit the REST API to signed-in users with a list of routes left public.
• Require strong passwords for administrators and editors, and optionally refuse passwords found in known breaches.
• Every switch says what could stop working, so you can decide.
• File protection that is verified. The plugin requests debug.log , readme files (WordPress’s own readme.html and license.txt included) and the uploads folder from your own site and shows what came back. On Apache and LiteSpeed it can add the rules for you; on nginx it shows the lines to add.
• File permissions. The key files and folders with their permissions; anything every account on the server may write to is flagged and fixed with one click.
• Replace the secret keys in wp-config.php after a suspected break-in, which signs everyone out. The new file is checked before it replaces the old one, and the old one is put back if the site does not answer.

Scanner

• Known vulnerabilities in WordPress, plugins and themes, checked daily, with one alert per new finding.
• WordPress files compared with the official release: changed, missing, and files that do not belong. .htaccess , .user.ini and wp-config.php are checked for injected rules and code, and must-use plugins and drop-ins are listed.
• Plugin and theme files compared with their WordPress.org releases; a changed file can be put back from the official copy.
• Code changes outside updates. A fingerprint of every plugin and theme, including the ones WordPress.org cannot verify; a change without a new version is reported.
• Database content checked for invisible iframes and obfuscated JavaScript in posts and settings.
• Suspicious code review of every PHP file in wp-content . Findings can be viewed and quarantined (renamed so they cannot run) and restored. Nothing is deleted.
• Scheduled scans , daily or weekly, in the background, with an email when something new turns up.

Activity

• Sign-ins of users who can edit the site, lockouts, user and role changes, plugin and theme changes, changes to critical site settings, and what the firewall refused. Optionally also content changes: posts and pages, media, menus, widgets, comment moderation and WooCommerce order status and settings. Routine entries make room first, so a busy shop or an attack cannot push the important ones out.
• Search, filter by type and importance, export to CSV. Bursts are folded into one entry.
• Email alerts for a new administrator, a new vulnerability, a new scan finding or a burst of lockouts, and an optional weekly summary. The same alerts can be posted to Slack or any webhook address.

Small and tidy

• No database tables. Everything is stored in a handful of capped options.
• No visitor is looked up with an outside service.
• Settings can be exported and imported. WP-CLI commands are included ( wp nhrrob-secure status --format=json for scripts).
• AI agent and MCP ready: on WordPress 6.9 and later, AI agents and MCP clients (through the WordPress MCP Adapter) can read the security score, the checks and the known vulnerabilities, and fix a few failed checks by switching on the setting behind them. Administrators only. Nothing an agent can do switches protection off.

What it is not

NHR Secure has no cloud threat feed and is not a malware cleaner. The request filter runs inside WordPress, and the scanner finds things for a person to review. If your site has been hacked, ask a professional clean-up service.

External Services

The plugin works without any outside service. The connections below are made only for the feature named.

WPVulnerability ( www.wpvulnerability.net ) — the vulnerability check. Sent: the slug of each installed plugin and theme, and your WordPress version. Nothing about your site, users or visitors. When: once a day, and when you press “Check now”. Service: https://www.wpvulnerability.com/ · Privacy: https://www.wpvulnerability.com/privacy/

WordPress.org ( api.wordpress.org , downloads.wordpress.org , core.svn.wordpress.org , plugins.svn.wordpress.org ) — the file comparisons. Sent: your WordPress version and language, and the slug and version of each plugin and theme, to fetch the official checksums or the theme’s release; the path of a file when you choose to replace it with the official copy. When: when you press “Compare now” or “Replace”, and during a scheduled scan if you have one. Privacy: https://wordpress.org/about/privacy/

Bot check: Cloudflare Turnstile, Google reCAPTCHA (v2 or v3) or hCaptcha — off unless you switch it on, choose one provider and enter your own keys. While it is on, the sign-in, register and lost-password screens (and pages with a comment for