WP Hostnasi Security Hardening

Step-by-step WordPress security hardening by Hostnasi Technologies
Version 1.0.2 · Requires WordPress 6.0+ · PHP 8.0+

A WordPress plugin that scans your site against 21 industry-standard security checks, shows a live 0–100% security score, and fixes 14 of those checks automatically — no technical knowledge required.

---

Table of Contents

• Why This Plugin
• Features
• Installation
• Using the Dashboard
• Security Checks Reference
  • Authentication & Login
  • wp-config.php Hardening
  • File & Directory Permissions
  • Updates & Plugins
  • HTTP Security Headers
  • Information Leakage
• Manual Steps Guide
• How Auto-Fixes Work
• Compatibility
• Troubleshooting
• File Structure
• Changelog
• Support

---

Why This Plugin

A freshly installed WordPress site with default settings typically passes fewer than 5 of these 21 checks. WordPress powers 43% of the web, making it the most targeted platform for automated attacks. This plugin closes the most common gaps in minutes.

Default WordPress site       After Hostnasi Security
────────────────────────     ──────────────────────────
Score: ~18%  ██░░░░░░░░     Score: 85%+  ████████░░
3–4 checks passing           17–21 checks passing

---

Features

Category	Checks	Auto-fixable
Authentication & login	4	3
wp-config.php hardening	5	3
File & directory permissions	3	3
Updates & plugins	4	1
HTTP security headers	3	3
Information leakage	3	3
Total	21	14

Built-in features (no third-party plugins needed):

• Login lockout — blocks IPs after 5 failed attempts for 30 minutes
• Hidden login URL — moves wp-login.php to a secret random slug
• XML-RPC disable
• Security headers (X-Frame-Options, HSTS, Referrer-Policy, Permissions-Policy)
• User enumeration block (/?author= and REST API /wp/v2/users)
• WordPress version hiding (meta tags, feeds, asset query strings)
• wp-config.php constant patching (DISALLOW_FILE_EDIT, FORCE_SSL_ADMIN, WP_DEBUG)
• .htaccess hardening (directory listing, sensitive file protection)
• wp-config.php permission fix (chmod 440)
• readme.html deletion

---

Installation

Method A — WordPress admin (recommended)

1. Download hostnasi-security.zip from your Hostnasi client area
2. In your WordPress admin, go to Plugins → Add New → Upload Plugin
3. Choose hostnasi-security.zip and click Install Now
4. Click Activate Plugin
5. Navigate to HN Security in the left sidebar — the scan runs immediately

Method B — FTP / cPanel File Manager

1. Extract hostnasi-security.zip on your computer
2. Upload the hostnasi-security/ folder to /wp-content/plugins/ on your server
3. Activate via Plugins → Installed Plugins

Requirements

Requirement	Minimum
WordPress	6.0
PHP	8.0
User role	Administrator
Web server	Apache or LiteSpeed (Nginx: partial — see Compatibility)

---

Using the Dashboard

Navigate to HN Security in your WordPress admin sidebar after activation.

Security score

  ╭──────╮
  │  73% │  ← Needs work (amber)
  ╰──────╯

  ✓ Good       80% and above
  ⚠ Needs work  50–79%
  ✗ At risk    Below 50%

The score updates live in the browser after each auto-fix — no page reload required.

Fix buttons

Each failing check shows one of two things:

• Green "Fix" button — click once; the fix applies via AJAX and the check turns green
• "Manual fix required" tag — the fix must be done outside the plugin (see Manual Steps Guide)

Hidden login URL info box

After enabling the hidden login URL, a green info box at the bottom of the dashboard shows your new login address:

Your hidden login URL: https://yoursite.com/secure-xk3p9mz2/

⚠️ Bookmark this immediately. Direct access to /wp-login.php will be blocked for bots — and for you if you forget the slug.

---

Security Checks Reference

🔐 Authentication & Login

Remove default "admin" username

Severity: Critical | Auto-fix: No (manual)

Every brute-force bot on the internet tries admin as the first username. A user account with this username is a permanent open invitation. Rename or delete it.

Detection: username_exists('admin') — fails if any account uses this username.

---

Limit login attempts

Severity: Critical | Auto-fix: Yes

Blocks IP addresses that repeatedly fail login — stops credential-stuffing and dictionary attacks without requiring a third-party plugin.

What the fix does:

• Enables a wp_login_failed hook that tracks failure counts per IP in WordPress transients
• After 5 failures within 10 minutes, the IP is blocked at the application layer for 30 minutes
• Correctly reads CF-Connecting-IP for sites behind Cloudflare

---

Hide wp-login.php from bots

Severity: Critical | Auto-fix: Yes

Moves the login page to a secret URL slug. Bots cannot attack a login page they cannot find.

What the fix does:

• Generates a random 8-character slug: secure-[random]
• Registers a WordPress rewrite rule pointing the slug to the login logic
• Requests to /wp-login.php from bots are silently redirected to the homepage
• The slug is displayed on the dashboard — bookmark it before enabling

---

Disable XML-RPC

Severity: Critical | Auto-fix: Yes

XML-RPC allows attackers to make thousands of login attempts in a single HTTP request (amplification attacks) and is frequently used for DDoS. Disable it unless your mobile app or Jetpack specifically requires it.

What the fix does:

• Hooks xmlrpc_enabled → __return_false
• Hooks xmlrpc_methods → __return_empty_array

---

⚙️ wp-config.php Hardening

Disable theme/plugin file editor

Severity: Critical | Auto-fix: Yes

The built-in editor in Appearance → Theme File Editor and Plugins → Plugin File Editor lets anyone with admin access run arbitrary PHP code. Disabling it removes this escalation path — so a compromised admin password cannot become a full server compromise.

What the fix does: Inserts define('DISALLOW_FILE_EDIT', true); into wp-config.php

---

Force HTTPS for wp-admin

Severity: Critical | Auto-fix: Yes (requires active SSL)

Ensures all admin panel traffic is encrypted. Without this, session cookies can be intercepted on shared or public networks.

What the fix does: Inserts define('FORCE_SSL_ADMIN', true); into wp-config.php

Requires a valid SSL certificate. The fix button will return an error if the site is not currently served over HTTPS.

---

Non-default database table prefix

Severity: Critical | Auto-fix: No (manual — ideally set at install time)

The default wp_ prefix makes SQL injection attacks easier — an attacker who finds an injection vulnerability immediately knows your table names.

Detection: Checks $wpdb->prefix !== 'wp_'

This is safest to change during WordPress installation. Changing it on a live site requires a full database backup and careful find-and-replace across all table names and serialized data.

---

WP_DEBUG disabled on production

Severity: High | Auto-fix: Yes

Debug mode leaks file paths, database errors, and stack traces directly to visitors — invaluable information for an attacker mapping your installation.

What the fix does: Inserts or updates define('WP_DEBUG', false); in wp-config.php

---

Security keys & salts are set

Severity: High | Auto-fix: No (manual)

WordPress security keys and salts are used to encrypt session cookies and authentication tokens. Default or missing keys make stolen cookies reusable. The plugin checks that all four primary keys (AUTH_KEY, SECURE_AUTH_KEY, LOGGED_IN_KEY, NONCE_KEY) are defined and at least 40 characters long.

Generate fresh keys: https://api.wordpress.org/secret-key/1.1/salt/

---

📁 File & Directory Permissions

wp-config.php permissions (440/400)

Severity: Critical | Auto-fix: Yes

On shared hosting, other users on the same server can read world-readable files. wp-config.php contains your database credentials — it should never be readable by anyone except the server process.

What the fix does: chmod(wp-config.php, 0440) — owner and group can read, no write, no world access

Detection: Checks for permissions 400, 440, 600, or 640

---

Directory listing disabled

Severity: High | Auto-fix: Yes

When a directory has no index.php, Apache shows a file browser by default. This exposes your directory structure, plugin list, uploaded file names, and backup files.

What the fix does: Appends Options -Indexes to the root .htaccess

---

Protect .htaccess and sensitive files

Severity: High | Auto-fix: Yes

Prevents direct HTTP access to configuration and log files that should never be publicly accessible.

What the fix does: Appends to root .htaccess:

# HNS_PROTECT_DOTFILES
<FilesMatch "^(\.htaccess|\.htpasswd|wp-config\.php|debug\.log|readme\.html|license\.txt)$">
    Order Allow,Deny
    Deny from all
</FilesMatch>

---

🔄 Updates & Plugins

WordPress core is up to date

Severity: Critical | Auto-fix: No (action required in Dashboard → Updates)

Outdated WordPress core has publicly disclosed CVEs that automated scanners actively exploit. This check fires whenever a new core version is available.

Detection: get_core_updates() — fails if any update with response != 'latest' is available

---

No plugins with pending updates

Severity: Critical | Auto-fix: No (action required in Dashboard → Updates)

Vulnerable plugins are the #1 attack vector on WordPress. A single unpatched plugin (e.g. an old file manager, form builder, or page builder) can give an attacker shell access regardless of every other security measure in place.

Detection: get_site_transient('update_plugins')->response — fails if non-empty

---

No inactive plugins installed

Severity: Critical | Auto-fix: No (manual deletion required)

Inactive plugins are still on the filesystem and still exploitable — deactivating is not enough. Delete plugins you are not using.

Detection: Compares get_plugins() count against active_plugins option

---

Minor core auto-updates enabled

Severity: High | Auto-fix: Yes

Minor WordPress updates (e.g. 6.4.1 → 6.4.2) are almost always security patches. Enabling auto-updates ensures they are applied without waiting for manual action.

What the fix does: update_option('auto_update_core_minor', true)

---

🛡️ HTTP Security Headers

All three header checks are controlled by a single option (hns_security_headers_enabled). Enabling any one of them enables all five headers simultaneously.

What the fix does: Hooks send_headers to output:

X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: geolocation=(), microphone=(), camera=()
Strict-Transport-Security: max-age=31536000; includeSubDomains  (HTTPS sites only)

X-Frame-Options

Severity: High | Auto-fix: Yes

Prevents your site from being embedded in `