WP Manifestindependent plugin directory
manifest / security / wp-jenga-security

Jenga Security

Lightweight WordPress security plugin — login page rename, math CAPTCHA, IP whitelist, brute-force lockout, force logout, security headers, disable XML-RPC & user enumeration, and activity log. Zero external dependencies. All features individually toggleable via admin UI.

by Schbang · github.com/adityasch84/wp-jenga-security · website

★ 0stars
0forks

Install

No release zip yet. The repository archive installs, but the folder name will carry the branch suffix and updates will not flow:

wp plugin install https://github.com/adityasch84/wp-jenga-security/archive/refs/heads/main.zip
Readme github.com/adityasch84/wp-jenga-security ↗

Lightweight WordPress security plugin with essential protection features. Zero external dependencies. Vulnerability-free by design.

Features

Login Page Rename

  • Replace /wp-login.php with a custom slug (e.g., /my-login)
  • Direct access to wp-login.php returns 404
  • All login/logout/register/lost-password URLs are automatically rewritten
  • No core file modifications — works entirely via hooks

Math CAPTCHA

  • Adds a numeric math question (e.g., "7 + 3 = ?") to forms
  • Server-side answer verification via transients (no cookies, no JS dependency)
  • Single-use tokens prevent replay attacks
  • Configurable for: login, registration, lost password forms

IP Whitelist

  • Restrict login page access to specific IP addresses
  • Supports single IPs and CIDR notation (e.g., 192.168.1.0/24)
  • Auto-includes current admin IP to prevent self-lockout
  • Comment support (lines starting with #)

Brute Force Lockout

  • Track failed login attempts per IP in a database table
  • Configurable: max attempts, lockout duration, counter reset period
  • Counter resets on successful login
  • View and clear active lockouts from admin

Force Logout

  • Force logout ALL users (preserves your own session)
  • Force logout a specific user by selection
  • View currently active sessions count per user

Security Headers

  • X-Frame-Options (DENY / SAMEORIGIN)
  • X-Content-Type-Options: nosniff
  • X-XSS-Protection: 1; mode=block
  • Referrer-Policy (multiple options)
  • Permissions-Policy (custom directives)
  • Strict-Transport-Security (HSTS) — only on HTTPS

WordPress Hardening

  • Disable XML-RPC (blocks xmlrpc.php with 403)
  • Disable user enumeration (?author=N redirects to home)
  • Disable Theme/Plugin file editor (DISALLOW_FILE_EDIT)
  • Hide WordPress version from HTML, feeds, and asset URLs
  • Restrict REST API /wp/v2/users to authenticated users only

Activity Log

  • Records: login successes, failures, lockout triggers, whitelist blocks, user enumeration attempts, force logouts
  • Filterable by status and event type
  • Paginated view
  • Auto-cleanup of entries older than 90 days
  • Manual clear option

Security Design

  • Every form uses WordPress nonces for CSRF protection
  • All inputs are sanitized via WordPress sanitization functions
  • Database queries use $wpdb->prepare() for SQL injection prevention
  • CAPTCHA tokens are single-use transients (no replay attacks)
  • IP validation uses filter_var() with proper flags
  • Capability checks on every admin action (manage_options, export)
  • No eval(), no file_get_contents() on URLs, no remote code execution vectors
  • Self-lockout prevention: admin IP is auto-whitelisted; force logout preserves your session

Installation

  1. Upload the jenga-security folder to /wp-content/plugins/
  2. Activate via Plugins > Installed Plugins
  3. Configure via the Jenga Security menu in wp-admin

Requirements

  • WordPress 5.0+
  • PHP 7.4+
  • MySQL 5.6+ (for activity log and lockout tables)