WP Manifestindependent plugin directory
manifest / security / thessley-security-hardening

Thessley Security Hardening

Thessley Security Hardening — modular WordPress security plugin

by Martin Lundstrom · github.com/netmate1234/thessley-security-hardening

★ 0stars

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/netmate1234/thessley-security-hardening/archive/refs/heads/main.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/netmate1234/thessley-security-hardening ↗

Thessley Security Hardening

Modular WordPress security hardening — perimeter blocking, request inspection, integrity and malware detection, hardening and alerts — with one Event Log across every module.

Quick install

wp plugin install https://github.com/netmate1234/thessley-security-hardening/releases/latest/download/thessley-security-hardening-1.0.24.zip --activate

Or upload the release zip under Plugins → Add New → Upload Plugin.

Verify: the Thessley Security Hardening menu appears and Event Log lists the site's events.

Requirements: WordPress 6.0+, PHP 8.3+.

What it does

  • Perimeter: IP blocklist from public feeds, geo blocking, geo-login for wp-login.php, per-IP rate limiting.
  • Request inspection: SQL injection, XSS, traversal and command-injection signatures; failed-login lockout.
  • Detection: file integrity against WordPress.org checksums, malware signatures, vulnerability scan, user watchdog.
  • Hardening: removes the tools an attacker reaches for after getting in; security headers; user enumeration.
  • Operations: one Event Log with severity 1–20, Telegram/email alerts, activity and bot logs, config import/export.

Every module can run in log-only or enforcing mode, independently — nothing is all-or-nothing.

Install

  1. Upload the thessley-security-hardening folder to wp-content/plugins/, or install the zip from Releases.
  2. Activate it, then open Thessley Security Hardening and enable the modules you want.
  3. The Event Log records everything regardless of which alerts you configure.

Requires WordPress 6.0+ and PHP 8.3+. No external service is called unless you configure one.

  • Thessley — the project family and overview deck
  • Thessley Passkey — the passwordless login plugin (split out of this one in 1.0.24)

License

GPL-2.0-or-later.