JAT Site Shield

Lock WordPress down: login lockouts, two-factor codes, core hardening, an activity log with email alerts, and file integrity checks. One plugin, safe defaults, no account.

Version 1.0.2 · Changelog · Roadmap · Free Cloudflare setup guide

Free · no paid version · no sign-up · nothing sent to us

By Jeremy Anderson Tech · Pairs with JAT Shell Scanner · Need hands-on help? Book a call

[!TIP] Site Shield keeps attackers out; JAT Shell Scanner checks whether one already got in. Use both on every site you look after.

Contents

• What it does
• Screenshots
• Requirements
• Install
• Recommended setup for a client site
• Cloudflare
• If you get locked out
• WP-CLI
• How it works
• For developers
• Privacy and external services
• Known limits
• Roadmap
• Contributing, support and security
• License and credits

What it does

Screenshots

Requirements

• WordPress 6.4 or newer
• PHP 7.4 to 8.4 (tested in CI on 7.4, 8.0, 8.1, 8.2, 8.3 and 8.4)
• Single sites. Multisite works, but the custom login address is turned off there.

Install

1. In WordPress, go to Plugins → Add New, search for "JAT Site Shield", then install and activate it. Until the directory listing is live, download jat-site-shield.zip from Releases (or build it with bash bin/build-zip.sh) and use Upload Plugin.
2. You'll be asked to set up two-factor for your administrator account. Scan the QR code, enter the code, and save your backup codes in your password manager.
3. Open Site Shield → Overview and work through anything on the checklist that isn't green.

Updates come through the WordPress.org plugin directory like any other plugin.

Recommended setup for a client site

1. Activate and enroll in two-factor yourself.
2. Settings → Login protection: turn on Move the login page, pick an address that isn't easy to guess, and save. Bookmark it and put it in your password manager.
3. Settings → Hardening: click Test it now under "Block PHP in the uploads folder". If PHP still runs, the server ignores .htaccess (nginx); ask the host to block PHP in wp-content/uploads.
4. Settings → Monitoring and alerts: add your agency's alert address, then Send a test alert.
5. Put the site behind Cloudflare's free plan with the free Cloudflare setup guide.
6. Run a file integrity scan and accept anything that's expected.

Things to know

• Back up the two-factor key. Secrets are encrypted with wp-content/jatss-key.php, created on activation. Include it in backups and migrations; if it's lost, every user's two-factor must be reset. On sites with several servers, or a read-only wp-content, put define( 'JATSS_SECRET_KEY', '…at least 32 random characters…' ); in wp-config.php before anyone enrolls.
• Visitor login links. The custom login address is only shown to people already on the login page or logged in. Login links a theme shows to logged-out visitors ("Log in to reply") keep pointing at wp-login.php and return "Not Found". On membership sites, link to the new address yourself or leave this feature off.

Cloudflare

Site Shield detects Cloudflare by itself and reads real visitor IPs from Cloudflare's header, but only when the request really comes from Cloudflare's network, so the header can't be faked. Settings → Network shows what every IP source reports and which one Site Shield uses.

The free Cloudflare setup guide walks through SSL Full (strict), locking your server to Cloudflare, five firewall rules, the free rate-limiting rule, bot settings, and caching without breaking logins.

If you get locked out

WP-CLI

wp jat-shield status              # checklist of protections
wp jat-shield login-url           # print the custom login address
wp jat-shield lockouts            # list locked-out IPs
wp jat-shield unlock <ip|all>     # lift lockouts (IPv6 /64 ranges too)
wp jat-shield reset-2fa <user>    # remove a user's two-factor
wp jat-shield scan [--all]        # run a file integrity scan now
wp jat-shield log [--severity=warning] [--count=50] [--format=json]

How it works

flowchart LR
    subgraph WP[WordPress request]
      A[Login form] -->|password OK| B{Two-factor enrolled?}
      B -- yes --> C[Code step]
      B -- no --> D[Logged in]
      C -->|valid code| D
    end
    CF[Cloudflare<br/>optional] --> WP
    L[Lockouts] -.blocks.-> A
    H[Hardening] -.filters.-> WP
    WP --> E[(Event log table)]
    F[File integrity<br/>daily, in steps] --> E
    E --> M[Email alerts]
    E -.planned.-> S[SOC / SIEM sender]

Every event goes through one function, JATSiteShield\Event_Log::log(), which fires jatss_event_logged. The planned SOC connection hooks that action; nothing else has to change.

For developers

Privacy and external services

The activity log stores IP addresses, user agents and usernames for security events in your own database, for 90 days by default. Nothing is sent to Jeremy Anderson Tech. The only outside requests are the file integrity scan's downloads of official checksums from WordPress.org: your WordPress version and language for core, and each plugin's slug and version. See readme.txt for the full disclosure.

Known limits

• Logins over the REST API (JWT plugins) aren't supported for users with two-factor; use application passwords.
• Lockouts are stored as transients. On several servers, use a shared object cache (Redis or Memcached) for lockouts to apply everywhere.
• The file check needs WP-Cron. On quiet sites, or with DISABLE_WP_CRON, add a server cron job for wp-cron.php.
• PHP-in-uploads blocking is written as .htaccess (Apache and LiteSpeed). On nginx, ask the host, or use the Cloudflare rule in the guide.

Roadmap

Next up: vulnerability alerts for installed plugins, re-confirming two-factor before dangerous actions, and passkeys. See ROADMAP.md for the full plan and what's deliberately out of scope.

Contributing, support and security

• Questions and help: see SUPPORT.md.
• Bugs and ideas: open an issue.
• Code: see CONTRIBUTING.md. main is protected; changes go through pull requests with passing CI.
• Security problems: report them privately, never in a public issue. See SECURITY.md.

Everyone taking part is expected to follow the code of conduct.

License and credits

GPL-2.0-or-later. See LICENSE. The bundled QR code library is qrcode-generator by Kazuhiko Arase (MIT).

Built by Jeremy Anderson of Jeremy Anderson Tech: WordPress development, security hardening and AI tools. Services · Book a call