WP Manifestindependent plugin directory
manifest / security / wpsecuritykit

SecurityKit — Website Hardening

SecurityKit: opt-in WordPress hardening toolkit: security headers, XML-RPC and user-enumeration limits, login limiter, activity log, alerts and a security score.

by RBN Bilişim · github.com/rbncore/wpsecuritykit · website

★ 0stars
6release downloads
0.1.2latest · 2d ago

Install

Download securitykit-0.1.2.zip From the 0.1.2 release on GitHub, Oct 31, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/rbncore/wpsecuritykit/releases/download/0.1.2/securitykit-0.1.2.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/rbncore/wpsecuritykit ↗

SecurityKit

SecurityKit closes the public doors of a WordPress site — response headers, XML-RPC, user enumeration, version details, the theme/plugin file editor and repeated login attempts — one switch at a time. Nothing is on after installation: the site behaves exactly as before until you turn a module on.

AdminKit is required

SecurityKit does not work without the AdminKit plugin. Its header declares Requires Plugins: adminkit.

  • On WordPress 6.5 and later WordPress refuses to activate SecurityKit while AdminKit is missing or inactive.
  • A second check runs on every request: without AdminKit, or with an AdminKit older than core API level 4, SecurityKit adds no hook, prints nothing and shows one admin notice with a link to activate AdminKit (when installed) or to download it.
  • AdminKit supplies the RBN Kit menu, the admin interface kit, the settings engine, the cache and log records, and the central updater.

Modules (all off by default)

Module What it does Why it is safe to try
Security headers nosniff, Referrer-Policy, Permissions-Policy, X-Frame-Options; HSTS and CSP as separate switches A header the server already sends is never sent twice; HSTS and CSP are off by default
XML-RPC closes XML-RPC, or only the multicall amplification Jetpack calls can be kept open; the screen shows whether XML-RPC is open
User enumeration closes /?author=N and /wp-json/wp/v2/users Logged-in users and the editor are not affected
Version details removes the generator tag and the core ?ver= Theme and plugin versions stay, so caches keep working
File editor closes the theme/plugin editor with map_meta_cap Does nothing when DISALLOW_FILE_EDIT is already defined
Login attempts temporary lock after too many wrong passwords Atomic counters, proxy trust switch, whitelist
wp-config.php advice lists missing recommended constants Read-only: the plugin never writes wp-config.php
Activity log records sign-ins, user and role changes, plugin and theme changes, setting changes and blocked file-editor attempts in the central AdminKit log Names and addresses are stored only as a daily salted digest; old rows are pruned nightly
E-mail alerts one plain-text message on a new administrator, repeated failed sign-ins, a lockout or a protection switched off Each event type is limited to one message per time window
Security score one number 0–100 with the weakest points and the exact fix Read-only: it changes nothing and contacts no external service

How it works

  • One list. Registry::MODULES names the modules; the screen, the settings schema and the boot loop are derived from it.
  • Off means not loaded. Each module has a small identity class (name, description, schema — always loaded because the single settings option must declare its fields) and a Runtime class with the hooks. The Runtime file is loaded only while the module is on; the test tests/modul-sozlesmesi-test.php proves it.
  • One settings option. securitykit_settings, nested by module (headers.nosniff). Reading, validation and saving are the AdminKit settings engine's job; the plugin only declares the schema.
  • No table. Deleting the plugin removes the option only when “delete the settings” was switched on.

Requirements

  • WordPress 6.5 or later
  • PHP 8.1 or later
  • AdminKit, installed and active (Requires Plugins: adminkit)

Updating

Updates come from the official releases on GitHub and appear on the Plugins page like any WordPress update. The package is verified (SHA-256 + signature) by the AdminKit updater before installation.

Development

  • Design and module contract: docs/tasarim.md
  • Tests (real WordPress + MySQL): tests/modul-sozlesmesi-test.php, tests/ayar-motoru-test.php, tests/uninstall-test.php — the uninstall layer also runs inside adminkit/tests/uninstall-kapi-test.php.
  • Source layout: src/ is the plugin and its own git repository; tests/ and docs/ live in the workspace repository.

License

GPL-2.0-or-later. See LICENSE and NOTICE.

Releases

2 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
0.1.2 latest
Oct 31, 2026 2d ago
securitykit-0.1.2.zip +2 assets
7
securitykit-0.1.2.zip3
securitykit-0.1.2.zip.sha2562
securitykit-0.1.2.zip.sig2
0.1.1
Oct 31, 2026 3d ago
securitykit-0.1.1.zip +2 assets
6
securitykit-0.1.1.zip3
securitykit-0.1.1.zip.sha2562
securitykit-0.1.1.zip.sig1