WP Manifestindependent plugin directory
manifest / security / ronipass

RoniPass – Security for WordPress

RoniPass turns a practical WordPress security checklist into enforceable controls, visibility, and clear remediation guidance. It is intentionally conservative: the plugin applies safe application-level protections and reports infrastructure changes that should remain under operator control.

by Lab Tech · github.com/sallarrabiei/ronipass · website

★ 0stars
0forks

Install

No release zip yet. The repository archive installs, but the folder name will carry the branch suffix and updates will not flow:

wp plugin install https://github.com/sallarrabiei/ronipass/archive/refs/heads/main.zip

Readme

RoniPass – Security for WordPress

RoniPass is a WordPress security plugin that helps site owners identify weaknesses, protect account access, and apply safe application-level hardening from one dashboard.

Key features

  • Security score and checks for WordPress updates, HTTPS, backups, configuration, and account hygiene.
  • Progressive login lockouts that slow brute-force and credential-stuffing attacks.
  • TOTP two-factor authentication for Google Authenticator, 1Password, Authy, and compatible apps.
  • Optional role-based 2FA enforcement with a seven-day enrollment period.
  • Strong-password requirements and generic login error messages.
  • Protection against XML-RPC abuse, REST API user enumeration, and author-ID scanning.
  • Browser security headers, optional report-only CSP, and reduced WordPress version disclosure.
  • Security event logging and optional administrator-login email alerts.

Requirements

  • WordPress 6.5 or newer
  • PHP 8.0 or newer

Installation

  1. Download the RoniPass plugin ZIP.
  2. In WordPress, open Plugins → Add Plugin → Upload Plugin.
  3. Upload the ZIP, install it, and activate RoniPass – Security for WordPress.
  4. Open RoniPass in the WordPress admin menu.
  5. Review the security checks and configure the protection settings for your site.

Before enforcing two-factor authentication, enroll at least two administrator accounts and inform affected users.

Security approach

RoniPass applies protections that are safe to manage inside WordPress. Hosting-specific changes—such as firewall and CDN rules, filesystem permissions, database prefixes, server configuration, and backup storage—remain under the site operator’s control.

Security is strongest when RoniPass is combined with current WordPress software, HTTPS, off-site backups, managed hosting, and a properly configured firewall or CDN.

License

GPL-2.0-or-later.

Read the full README on GitHub →