WP Security Hardening

A comprehensive WordPress security hardening plugin built from years of experience managing 15+ production WordPress sites. No bloat, no upsells — just solid security practices implemented the right way.

Why This Plugin?

Most security plugins are overloaded with features you don't need and nag you to upgrade. This plugin does one thing well: hardens your WordPress installation using proven techniques, with zero performance impact.

Built from real-world experience securing client sites across multiple hosting environments (WP Engine, shared hosting, VPS).

Features

🔒 Core Security

• Disable XML-RPC — Blocks the most common brute force and DDoS attack vector
• Disable File Editing — Removes theme/plugin editor from admin (DISALLOW_FILE_EDIT)
• Hide WordPress Version — Strips version info from page source, scripts, and styles
• Block REST API User Enumeration — Prevents username discovery through /wp/v2/users
• Remove Unnecessary Meta — Cleans up RSD, WLW manifest, shortlinks, and oEmbed discovery

🌐 HTTP Security Headers

• X-Frame-Options (clickjacking protection)
• X-Content-Type-Options (MIME sniffing prevention)
• Referrer-Policy (privacy-respecting referrer control)
• Permissions-Policy (restrict browser feature access)
• Content-Security-Policy (configurable via filter)
• HSTS (opt-in, for SSL-enabled sites)
• Server header removal

🔐 Login Protection

• Rate Limiting — Configurable max attempts with IP-based lockouts
• Honeypot Field — Invisible trap that catches automated bot submissions
• Custom Login URL — Replace wp-login.php with a custom slug
• Login Activity Log — Tracks last 10 successful logins per user with IP and User Agent
• Cloudflare Compatible — Proper IP detection through CF-Connecting-IP header

📁 File & Database Security

• Block PHP execution in /uploads/ directory
• Validate upload content beyond extension checking (detects disguised PHP files)
• Block double extensions (malware.php.jpg)
• Database prefix change advisory
• Scheduled file permission monitoring for critical files
• .htaccess hardening rules generator

⚡ WP-CLI Commands

Full security management from the command line:

# Run a comprehensive security audit with scoring
$ wp security audit

╔══════════════════════════════════════════╗
║   WP Security Hardening — Full Audit     ║
╚══════════════════════════════════════════╝

+----------+------------------------+--------+----------+
| Category | Check                  | Status | Severity |
+----------+------------------------+--------+----------+
| Core     | XML-RPC Disabled       | ✓ PASS | HIGH     |
| Core     | File Editing Disabled  | ✓ PASS | HIGH     |
| Core     | SSL Enabled            | ✓ PASS | CRITICAL |
| Headers  | Security Headers Active| ✓ PASS | HIGH     |
| Login    | Brute Force Protection | ✓ PASS | CRITICAL |
| Files    | Uploads PHP Blocked    | ✓ PASS | CRITICAL |
+----------+------------------------+--------+----------+

Security Score: 13/14 (93%) — Grade: A

# Check recent login activity
$ wp security logins --days=7

# Verify file permissions
$ wp security permissions

# View active lockouts
$ wp security lockouts

# Generate .htaccess rules (preview)
$ wp security htaccess --dry-run

# Install .htaccess rules
$ wp security htaccess --install

# Cleanup old records
$ wp security cleanup --days=30

Installation

Manual Installation

1. Download or clone this repository
2. Upload the wp-security-hardening folder to /wp-content/plugins/
3. Activate through Plugins → Installed Plugins
4. Configure at Settings → Security Hardening

Via WP-CLI

# Clone and activate
$ cd wp-content/plugins/
$ git clone https://github.com/YOUR_USERNAME/wp-security-hardening.git
$ wp plugin activate wp-security-hardening

# Run initial audit
$ wp security audit

Configuration

All settings are available under Settings → Security Hardening in the WordPress admin.

A dashboard widget shows your current security score at a glance.

Recommended Settings for Production

Setting	Recommended	Notes
Disable XML-RPC	✅ Yes	Unless you use Jetpack or the WP mobile app
Disable File Editing	✅ Yes	Always in production
Hide WP Version	✅ Yes	No downside
Security Headers	✅ Yes	Test CSP compatibility first
HSTS	⚠️ Careful	Only if you're committed to SSL permanently
Login Protection	✅ Yes	Set max attempts to 5
Custom Login URL	Optional	Good additional layer

Extensibility

Customize Content Security Policy

add_filter( 'wpsh_csp_directives', function( $directives ) {
    // Add Google Analytics
    $directives[] = "script-src 'self' 'unsafe-inline' *.google-analytics.com *.googletagmanager.com";
    return $directives;
});

Hook Into Lockout Events

add_action( 'wpsh_ip_locked_out', function( $ip, $username, $attempts ) {
    // Send notification to Slack, email, etc.
    wp_mail(
        get_option( 'admin_email' ),
        'Security Alert: IP Locked Out',
        sprintf( 'IP %s locked out after %d failed attempts (user: %s)', $ip, $attempts, $username )
    );
}, 10, 3 );

Customize Allowed Upload Types

add_filter( 'wpsh_allowed_mimes', function( $mimes ) {
    // Allow SVG uploads (use with caution)
    $mimes['svg'] = 'image/svg+xml';
    return $mimes;
});

Compatibility

• WordPress: 5.8+
• PHP: 7.4+ (8.0+ recommended)
• Hosting: WP Engine, SiteGround, Cloudways, shared hosting, VPS
• Page Builders: Divi, Elementor, Gutenberg
• Multilingual: WPML, Polylang
• CDN: Cloudflare (proper IP detection included)
• Caching: Compatible with WP Super Cache, W3 Total Cache, WP Engine caching

Security Philosophy

This plugin follows a defense-in-depth approach:

1. Reduce attack surface — Disable features you don't need (XML-RPC, file editing, user enumeration)
2. Harden transport — Enforce HTTPS, set security headers
3. Protect authentication — Rate limit logins, add honeypots, hide login URL
4. Secure the filesystem — Block PHP in uploads, validate file content, monitor permissions
5. Enable auditing — CLI tools for regular security reviews

Contributing

Contributions are welcome! Please:

1. Fork the repository
2. Create a feature branch (git checkout -b feature/amazing-feature)
3. Follow WordPress Coding Standards (phpcs --standard=WordPress)
4. Commit your changes (git commit -m 'Add amazing feature')
5. Push to the branch (git push origin feature/amazing-feature)
6. Open a Pull Request

License

This project is licensed under the GPL v2 or later — see the LICENSE file for details.

Changelog

1.0.0 (2026-03-01)

• Initial release
• Core security hardening (XML-RPC, file editing, version hiding, REST API)
• HTTP security headers with configurable CSP
• Login protection with rate limiting and honeypot
• File security with upload validation and permission monitoring
• WP-CLI security audit commands
• Admin settings page with dashboard widget