WP Manifestindependent plugin directory
manifest / security / sitesecure

SiteSecure

SiteSecure is a WordPress security plugin that helps protect your site from common threats

by Plugir · github.com/abhilashsahoo/sitesecure

★ 0stars
0forks

Install

No release zip yet. The repository archive installs, but the folder name will carry the branch suffix and updates will not flow:

wp plugin install https://github.com/abhilashsahoo/sitesecure/archive/refs/heads/main.zip
Readme github.com/abhilashsahoo/sitesecure ↗

SiteSecure Security

A comprehensive security plugin for WordPress — protect your site from brute force attacks, harden headers, and lock down sensitive areas.

Description

SiteSecure is a WordPress security plugin that helps protect your site from common threats: brute force attacks, unauthorized access, and malicious activity. It combines multiple hardening options in one place with a simple setup wizard.

Features

General

  • Remove WordPress version — Hide version from source to reduce exploit surface.
  • Disable file editor — Turn off theme/plugin editor to prevent code tampering.
  • Remove RSS feeds — Reduce content scraping.
  • Remove REST API / oEmbed links — Limit exposure of APIs and discovery.
  • Custom login URL — Move wp-login to a custom path.
  • Enforce SSL — Force HTTPS.

Brute force protection

  • Log successful and failed logins.
  • Login attempt limit and lockout duration.
  • Whitelist and blacklist IPs.

Security headers

  • Content Security Policy (CSP) — script-src, style-src, img-src, font-src, etc.
  • X-Content-Type-Options — Prevent MIME sniffing.
  • X-Frame-Options — Clickjacking protection.
  • X-XSS-Protection — Browser XSS filter.
  • Strict-Transport-Security (HSTS) — Enforce HTTPS.
  • Referrer-Policy and Permissions-Policy.

Database

  • Change database table prefix (with generator).

.htaccess

  • Protect .htaccess and .htpasswd.
  • Disable directory listing, limit login attempts, block bad bots.
  • Disable XML-RPC, prevent image hotlinking.
  • Restrict access to wp-config.php, wp-content, wp-includes.
  • Download .htaccess backup.

Session & tools

  • Session timeout for inactive users.
  • Successful and failed login logs; clear logs.
  • Password strength tool and crack-time estimate.
  • Salt security (rotate WordPress salts).
  • User enumeration prevention.

Installation

From WordPress admin

  1. Go to Plugins → Add New.
  2. Search for SiteSecure.
  3. Install and activate.
  4. Follow the post-activation steps in the plugin.

Manual

  1. Upload the site-secure folder to wp-content/plugins/.
  2. Activate SiteSecure under Plugins in WordPress.
  3. Configure via the plugin’s settings.

Requirements

  • WordPress: 6.3 or later
  • PHP: 7.4 or later
  • Tested up to: WordPress 6.5

FAQ

Do you guarantee my site will be fully secure?
No plugin can guarantee 100% security. SiteSecure adds a strong set of hardening features against common threats.

Will SiteSecure slow my site?
It’s built to be lightweight; it shouldn’t slow your site and can replace several other security plugins.

Do I need an account?
No account is required to use the plugin.

Can I use it with other security plugins?
It’s best to use one main security plugin to avoid conflicts. We recommend disabling others that overlap with SiteSecure.

Changelog

1.0.0 (12 March 2026)

  • Initial release with the features listed above.

Contributing

Contributions are welcome. Please open an issue or pull request on this repository.

License

This project is licensed under the GPLv3 or later. See the LICENSE file in the repository and GNU GPL v3 for the full text.