WP Manifestindependent plugin directory
manifest / security / wordpress-security-plus

WordPress Security Hardening

Comprehensive security hardening for WordPress - addresses user enumeration, version disclosure, and other vulnerabilities

by kian babaabady · github.com/kianbabai/wordpress-security-plus

★ 0stars
0forks

Install

No release zip yet. The repository archive installs, but the folder name will carry the branch suffix and updates will not flow:

wp plugin install https://github.com/kianbabai/wordpress-security-plus/archive/refs/heads/main.zip

Readme

WordPress Security Plus

A comprehensive must-use (MU) plugin for WordPress that hardens security by addressing common vulnerabilities including user enumeration, version disclosure, and other security issues.

Features

  • User Enumeration Protection: Blocks user enumeration via author archives, REST API, and RSS feeds
  • Version Hiding: Removes WordPress version from headers, RSS feeds, and asset URLs
  • XML-RPC Disabling: Completely disables XML-RPC functionality
  • Login Attempt Limiting: Limits failed login attempts per IP address
  • Security Headers: Adds essential security headers (X-Content-Type-Options, X-Frame-Options, etc.)
  • Directory Browsing Protection: Disables directory browsing (Apache/LiteSpeed only)
  • File Editing Protection: Disables file editing in WordPress admin
  • Sensitive Header Removal: Removes server information from headers

Installation

  1. Upload the security-plus.php file to your WordPress wp-content/mu-plugins/ directory
  2. The plugin will activate automatically (no activation needed for MU plugins)

Note: If the mu-plugins directory doesn't exist, create it first.

Requirements

  • WordPress 5.0 or higher
  • PHP 7.2 or higher
  • Tested up to WordPress 6.4

Important Notes

Server Compatibility

  • Directory Browsing Protection: Only works on Apache and LiteSpeed servers. For Nginx, you'll need to configure this in your server block.
  • File Operations: The plugin attempts to modify .htaccess files. Ensure proper file permissions are set.

Potential Conflicts

  • REST API: Disabling user endpoints may conflict with themes/plugins that rely on REST API user data
  • RSS Feeds: Author information is removed from RSS feeds, which may affect feed readers
  • XML-RPC: Completely disabled - may break Jetpack or other services that require XML-RPC

Login Attempt Limiting

  • Default limit: 5 failed attempts per IP/username combination
  • Lockout duration: 15 minutes
  • Uses WordPress transients for tracking

Configuration

The plugin uses constants and class properties for configuration:

const LOGIN_ATTEMPT_QUANTITY = 5; // Change this in the class to modify login attempt limit
const LOGIN_ATTEMP_DURATION = 15; //in munites

Security Considerations

  • This plugin modifies core WordPress behavior and should be tested in a staging environment first
  • Some features (like directory browsing protection) require file system write permissions
  • The plugin is designed as a must-use plugin to ensure it cannot be deactivated from the admin

License

GPL v2 or later

Author

kian babaabady - https://kianbabaabady.ir

Support

For issues, feature requests, or contributions, please use the GitHub issue tracker.

Changelog

1.0.0

  • Initial release
  • User enumeration protection
  • Version hiding
  • XML-RPC disabling
  • Login attempt limiting
  • Security headers
  • Directory browsing protection
  • RSS feed author removal

Read the full README on GitHub →