Security Hardener
Security Hardener applies WordPress security best practices based on the WordPress Advanced Administration / Security / Hardening documentation. It uses WordPress core functions and does not modify core files. It is a hardening tool, not a firewall or a malware scanner: it reduces your attack surfac
Security Hardener applies WordPress security best practices based on the WordPress Advanced Administration / Security / Hardening documentation. It uses WordPress core functions and does not modify core files.
It is a hardening tool, not a firewall or a malware scanner: it reduces your attack surface, and its checklist points out measures that have to be applied on your server.
Key Features
Files and updates: * Disable the file editor in WordPress admin * Optionally disable all file modifications (blocks updates and installations)
XML-RPC and pingbacks: * Disable XML-RPC completely, or keep it and remove only its pingback methods * Remove the X-Pingback header and block incoming and self-pingbacks
User enumeration: * Block /?author=N queries (returns 404) and the canonical redirects that expose usernames * Require login for REST API user endpoints and remove users from XML sitemaps * Optionally block author feed pages ( /author/username/feed/ ) * Optionally anonymize the author name in oEmbed responses
Login security: * Generic error messages (no username/password hints) * Login honeypot to silently block bots * Block registration of unsafe usernames (admin, root, test…) * Application Passwords disabled by default * IP-based rate limiting with configurable thresholds * Security event log (last 100 events, including IP addresses and usernames of failed attempts)
Security headers: * X-Frame-Options: SAMEORIGIN and X-Content-Type-Options: nosniff * Referrer-Policy: strict-origin-when-cross-origin * Permissions-Policy: geolocation=(), microphone=(), camera=() * Optional HSTS for HTTPS sites (max-age of 1 year, with optional includeSubDomains and preload )
Additional hardening: * Hide the WordPress version (meta generator tag and asset query strings) * Remove obsolete wp_head items (RSD, WLW manifest, shortlink, emoji scripts) * System Status: file permissions, WP_DEBUG, user registration, administrator accounts, PHP version, and database version * Interactive hardening checklist with saved progress, for measures that must be applied on your server
⚠️ Important: Always test security settings in a staging environment first. Some features may affect third-party integrations or plugins.
Privacy: This plugin does not send data to third parties and does not create custom database tables. It stores its settings, checklist progress, and a security event log in the WordPress options table. The log keeps the last 100 events, including IP addresses and the usernames used in failed login attempts, until you clear it. Login attempt tracking uses short-lived transients keyed by a hash of the IP address. The PHP check in System Status uses WordPress core’s cached recommendation, which core may refresh from api.wordpress.org. All data is preserved on uninstall by default and only deleted if you explicitly enable “Delete all data on uninstall”.
Automatic Installation
- 01Go to Plugins > Add New Plugin
- 02Search for Security Hardener
- 03Click Install Now and then Activate
- 04Configure settings at Settings > Security Hardener
Frequently asked questions.
What are the default settings?
Everything is enabled by default except: disabling all file modifications, blocking author feeds, anonymizing the oEmbed author, HSTS (with its subdomains and preload options), and deleting data on uninstall. Rate limiting blocks an IP address for 15 minutes after 5 failed attempts. You can review and change every option under Settings > Security Hardener .
An app or integration stopped working after I activated the plugin. What do I do?
Two defaults can affect integrations: XML-RPC is disabled, and Application Passwords are disabled. If you use Jetpack, the WordPress mobile app, or other tools that rely on them, turn off Disable XML-RPC and/or Disable Application Passwords under Settings > Security Hardener .
Does this plugin slow down my site?
No. The plugin uses lightweight WordPress hooks and native functions. Security headers add negligible overhead, and rate limiting only checks transients during login attempts.
I’m locked out after too many failed attempts. What do I do?
Blocks are per IP address and expire automatically after your configured block duration (default: 15 minutes). Wait for the block to expire, try from a different IP address, or:
- 01Access your database (phpMyAdmin, etc.)
- 02Search the options table for names containing wpsh_login_
- 03Delete those transient options
- 04Try logging in again
If your site uses a persistent object cache (Redis, Memcached), flush the cache instead.
I use a CDN or proxy (Cloudflare, etc.). How do I get the correct IP?
By default, rate limiting uses REMOTE_ADDR . If your site is behind a trusted proxy, add the proxy’s exact IP addresses to wp-config.php (IP ranges in CIDR notation are not supported):
define( 'WPSH_TRUSTED_PROXIES', array( '203.0.113.10', '203.0.113.11' ) );
For requests coming from those addresses, the plugin will then read the HTTP_CF_CONNECTING_IP (Cloudflare) or HTTP_X_FORWARDED_FOR header.
Does the plugin work with page caching?
It depends on the cache. Security headers are added by PHP when WordPress builds a response, so a full-page cache that serves pages without running PHP (some server-level caches do) may skip them. Check your response headers with your browser’s developer tools and, if they are missing, add them at the server level.
Can I use this with other security plugins?
Yes, but watch for overlaps. If another plugin also sends security headers you may get duplicates (usually harmless). If it also blocks user enumeration or limits login attempts, enable only one of them to avoid confusion.
Does this block the WordPress REST API?
No. The plugin only requires login to read user-related endpoints, and WordPress’s own permission checks still apply. All other REST API functionality, including public endpoints like oEmbed, works normally.
What happens to my data when I uninstall?
When you uninstall (not just deactivate) the plugin, data is preserved by default. If you enable Delete all data on uninstall under Settings > Security Hardener > Other settings , uninstalling deletes all plugin settings, security logs, and checklist progress. Temporary login-attempt data is not deleted right away: it expires on its own within 24 hours at most, and WordPress removes it automatically.
Deactivating the plugin always preserves all settings.
Does this plugin require HTTPS?
Not required, but strongly recommended. HSTS requires HTTPS, and for maximum security your entire site should use HTTPS with a valid certificate.
Is this plugin compatible with multisite?
The plugin is designed for single-site installations. Multisite compatibility has not been tested and is not officially supported at this time.
Try it for yourself.
Developer
