WP Manifestindependent plugin directory
manifest / security / wp-jenga-security

Jenga Security

Lightweight WordPress security plugin — login page rename, math CAPTCHA, IP whitelist, brute-force lockout, force logout, security headers, disable XML-RPC & user enumeration, and activity log. Zero external dependencies. All features individually toggleable via admin UI.

by Schbang · github.com/adityasch84/wp-jenga-security · website

★ 0stars

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/adityasch84/wp-jenga-security/archive/refs/heads/main.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/adityasch84/wp-jenga-security ↗

Lightweight WordPress security plugin with essential protection features. Zero external dependencies. Vulnerability-free by design.

Features

Login Page Rename

  • Replace /wp-login.php with a custom slug (e.g., /my-login)
  • Direct access to wp-login.php returns 404
  • All login/logout/register/lost-password URLs are automatically rewritten
  • No core file modifications — works entirely via hooks

Math CAPTCHA

  • Adds a numeric math question (e.g., "7 + 3 = ?") to forms
  • Server-side answer verification via transients (no cookies, no JS dependency)
  • Single-use tokens prevent replay attacks
  • Configurable for: login, registration, lost password forms

IP Whitelist

  • Restrict login page access to specific IP addresses
  • Supports single IPs and CIDR notation (e.g., 192.168.1.0/24)
  • Auto-includes current admin IP to prevent self-lockout
  • Comment support (lines starting with #)

Brute Force Lockout

  • Track failed login attempts per IP in a database table
  • Configurable: max attempts, lockout duration, counter reset period
  • Counter resets on successful login
  • View and clear active lockouts from admin

Force Logout

  • Force logout ALL users (preserves your own session)
  • Force logout a specific user by selection
  • View currently active sessions count per user

Security Headers

  • X-Frame-Options (DENY / SAMEORIGIN)
  • X-Content-Type-Options: nosniff
  • X-XSS-Protection: 1; mode=block
  • Referrer-Policy (multiple options)
  • Permissions-Policy (custom directives)
  • Strict-Transport-Security (HSTS) — only on HTTPS

WordPress Hardening

  • Disable XML-RPC (blocks xmlrpc.php with 403)
  • Disable user enumeration (?author=N redirects to home)
  • Disable Theme/Plugin file editor (DISALLOW_FILE_EDIT)
  • Hide WordPress version from HTML, feeds, and asset URLs
  • Restrict REST API /wp/v2/users to authenticated users only

Activity Log

  • Records: login successes, failures, lockout triggers, whitelist blocks, user enumeration attempts, force logouts
  • Filterable by status and event type
  • Paginated view
  • Auto-cleanup of entries older than 90 days
  • Manual clear option

Security Design

  • Every form uses WordPress nonces for CSRF protection
  • All inputs are sanitized via WordPress sanitization functions
  • Database queries use $wpdb->prepare() for SQL injection prevention
  • CAPTCHA tokens are single-use transients (no replay attacks)
  • IP validation uses filter_var() with proper flags
  • Capability checks on every admin action (manage_options, export)
  • No eval(), no file_get_contents() on URLs, no remote code execution vectors
  • Self-lockout prevention: admin IP is auto-whitelisted; force logout preserves your session

Installation

  1. Upload the jenga-security folder to /wp-content/plugins/
  2. Activate via Plugins > Installed Plugins
  3. Configure via the Jenga Security menu in wp-admin

Requirements

  • WordPress 5.0+
  • PHP 7.4+
  • MySQL 5.6+ (for activity log and lockout tables)