WP Manifestindependent plugin directory
manifest / security / security-basics-lite

Security Basics Lite

Adds security basics to your wordpress website

by Gideon Warrie · github.com/gideonwarrie/security-basics-lite

★ 0stars

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/gideonwarrie/security-basics-lite/archive/refs/heads/main.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/gideonwarrie/security-basics-lite ↗

A small WordPress plugin that applies a few common hardening steps. Written in PHP using WordPress hooks (actions and filters).

Features

  • Hides the WordPress version from the page source, and from script and style links (?ver=) when the number matches the core version.
  • Removes the WordPress emoji loader, which also exposes the version.
  • Blocks XML-RPC logins and removes the pingback methods and header.
  • Adds security headers: X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy.
  • Reduces user-name enumeration: blocks /?author=N scans and hides the REST API user list from logged-out visitors.

Install

  1. Download security-basics-lite.zip.
  2. In WordPress go to Plugins > Add New > Upload Plugin, choose the zip, then Activate.

How to check it works

  • Version hidden: view the page source and search for generator. No WordPress version should appear.
  • Author scan blocked: while logged out, open yoursite/?author=1. You should land on the home page.
  • REST users hidden: while logged out, open yoursite/wp-json/wp/v2/users. You should get a "no route" error.
  • Headers: scan your site at securityheaders.com.

Limitations

  • Disabling XML-RPC can break apps that depend on it.
  • Author archive pages at /author/username/ can still reveal usernames.
  • If a host or caching plugin serves saved copies of pages, WordPress's PHP never runs for them, so the headers will not appear on those pages. Some hosts also set their own Referrer-Policy, which can take precedence over this plugin's value.
  • This is a learning project, not a replacement for a full security plugin.

License

GPL-2.0-or-later