WP Manifestindependent plugin directory
manifest / security / wordpress-security-api-firewall

Bromate Security & API Firewall

Security, firewall, access control and data protection for WordPress and its REST API. Authentication, JWT support, route policies, rate limiting, response hardening and WordPress security tools in a single plugin.

by Sophabed · github.com/afterglowweb/wordpress-security-api-firewall

★ 0stars
0forks

Install

No release zip yet. The repository archive installs, but the folder name will carry the branch suffix and updates will not flow:

wp plugin install https://github.com/afterglowweb/wordpress-security-api-firewall/archive/refs/heads/main.zip

Readme

Bromate Security & API Firewall (currently under development)

A complete, 100% free WordPress security suite built on trust and transparency. From login hardening to REST API firewalls, protect your data without selling your soul to big tech.

Bromate Security & API Firewall is a complete security suite for WordPress, hardening login, core endpoints, and server-level exposure — including rate limiting, IP/GeoIP blocking, 2FA, and Recaptcha. It secures REST API access with JWT and Application Password hardening, per-route authentication and restriction rules to reduce data exposure.

Feature Description
Firewall Rate limiting, IPv4/IPv6 blacklisting, CIDR ranges, country blocking (GeoIP)
Login Hardening Login rate limiting, Recaptcha, 2FA, auth cookie protection, salt rotation schedule, sessions manager
Global Security Disable XML-RPC, comments, pingbacks, RSS/Atom, sitemap; security HTTP headers; secure file permissions
Application Authentication JWT and Application Passwords hardening, whitelist IPs and origins
Application Only Mode Redirect or hide front
REST Routes Enforce authentication and disable routes on a per-route basis and criteria
Logs Security event logs
REST Response Cache Response, Remove empty props, Resolve embedded data, flatten rendered fields, strip domain from URLs
Webhooks Fire secured webhooks on WordPress and plugins events, schedule recurring webhooks.

Requirements

  • WordPress 6.0+
  • PHP 7.4+

Install

1. Download or clone this repository into your wp-content/plugins/ directory

cd wp-content/plugins/
git clone https://github.com/AfterglowWeb/wordpress-security-api-firewall.git bromate-security-api-firewall

2. Activate the plugin through the WordPress admin

3. Navigate to the WP Security & API Firewall admin page.

Contributing

Contributions are welcome! Please open an issue or submit a pull request.

License

GPL-2.0-or-later

Read the full README on GitHub →