Bromate Security & API Firewall
Security, firewall, access control and data protection for WordPress and its REST API. Authentication, JWT support, route policies, rate limiting, response hardening and WordPress security tools in a single plugin.
Install
This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.
Install straight from GitHub with WP-CLI:
wp plugin install https://github.com/afterglowweb/wordpress-security-api-firewall/archive/refs/heads/main.zipBromate Security & API Firewall (currently under development)
A complete, 100% free WordPress security suite built on trust and transparency. From login hardening to REST API firewalls, protect your data without selling your soul to big tech.
Bromate Security & API Firewall is a complete security suite for WordPress, hardening login, core endpoints, and server-level exposure — including rate limiting, IP/GeoIP blocking, 2FA, and Recaptcha. It secures REST API access with JWT and Application Password hardening, per-route authentication and restriction rules to reduce data exposure.
| Feature | Description |
|---|---|
| Firewall | Rate limiting, IPv4/IPv6 blacklisting, CIDR ranges, country blocking (GeoIP) |
| Login Hardening | Login rate limiting, Recaptcha, 2FA, auth cookie protection, salt rotation schedule, sessions manager |
| Global Security | Disable XML-RPC, comments, pingbacks, RSS/Atom, sitemap; security HTTP headers; secure file permissions |
| Application Authentication | JWT and Application Passwords hardening, whitelist IPs and origins |
| Application Only Mode | Redirect or hide front |
| REST Routes | Enforce authentication and disable routes on a per-route basis and criteria |
| Logs | Security event logs |
| REST Response | Cache Response, Remove empty props, Resolve embedded data, flatten rendered fields, strip domain from URLs |
| Webhooks | Fire secured webhooks on WordPress and plugins events, schedule recurring webhooks. |
Requirements
- WordPress 6.0+
- PHP 7.4+
Install
1. Download or clone this repository into your wp-content/plugins/ directory
cd wp-content/plugins/
git clone https://github.com/AfterglowWeb/wordpress-security-api-firewall.git bromate-security-api-firewall2. Activate the plugin through the WordPress admin
3. Navigate to the WP Security & API Firewall admin page.
Contributing
Contributions are welcome! Please open an issue or submit a pull request.
License
GPL-2.0-or-later