WP Manifestindependent plugin directory
manifest / security / wordpress-security-plus

WordPress Security Hardening

Comprehensive security hardening for WordPress - addresses user enumeration, version disclosure, and other vulnerabilities

by kian babaabady · github.com/kianbabai/wordpress-security-plus

★ 0stars

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/kianbabai/wordpress-security-plus/archive/refs/heads/main.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/kianbabai/wordpress-security-plus ↗

A comprehensive must-use (MU) plugin for WordPress that hardens security by addressing common vulnerabilities including user enumeration, version disclosure, and other security issues.

Features

  • User Enumeration Protection: Blocks user enumeration via author archives, REST API, and RSS feeds
  • Version Hiding: Removes WordPress version from headers, RSS feeds, and asset URLs
  • XML-RPC Disabling: Completely disables XML-RPC functionality
  • Login Attempt Limiting: Limits failed login attempts per IP address
  • Security Headers: Adds essential security headers (X-Content-Type-Options, X-Frame-Options, etc.)
  • Directory Browsing Protection: Disables directory browsing (Apache/LiteSpeed only)
  • File Editing Protection: Disables file editing in WordPress admin
  • Sensitive Header Removal: Removes server information from headers

Installation

  1. Upload the security-plus.php file to your WordPress wp-content/mu-plugins/ directory
  2. The plugin will activate automatically (no activation needed for MU plugins)

Note: If the mu-plugins directory doesn't exist, create it first.

Requirements

  • WordPress 5.0 or higher
  • PHP 7.2 or higher
  • Tested up to WordPress 6.4

Important Notes

Server Compatibility

  • Directory Browsing Protection: Only works on Apache and LiteSpeed servers. For Nginx, you'll need to configure this in your server block.
  • File Operations: The plugin attempts to modify .htaccess files. Ensure proper file permissions are set.

Potential Conflicts

  • REST API: Disabling user endpoints may conflict with themes/plugins that rely on REST API user data
  • RSS Feeds: Author information is removed from RSS feeds, which may affect feed readers
  • XML-RPC: Completely disabled - may break Jetpack or other services that require XML-RPC

Login Attempt Limiting

  • Default limit: 5 failed attempts per IP/username combination
  • Lockout duration: 15 minutes
  • Uses WordPress transients for tracking

Configuration

The plugin uses constants and class properties for configuration:

const LOGIN_ATTEMPT_QUANTITY = 5; // Change this in the class to modify login attempt limit
const LOGIN_ATTEMP_DURATION = 15; //in munites

Security Considerations

  • This plugin modifies core WordPress behavior and should be tested in a staging environment first
  • Some features (like directory browsing protection) require file system write permissions
  • The plugin is designed as a must-use plugin to ensure it cannot be deactivated from the admin

License

GPL v2 or later

Author

kian babaabady - https://kianbabaabady.ir

Support

For issues, feature requests, or contributions, please use the GitHub issue tracker.

Changelog

1.0.0

  • Initial release
  • User enumeration protection
  • Version hiding
  • XML-RPC disabling
  • Login attempt limiting
  • Security headers
  • Directory browsing protection
  • RSS feed author removal