Spry Simple WP Security

A lightweight WordPress hardening plugin focused on three practical protections without the overhead of a full security suite.

Features

• Disable dashboard file editing by adding a marker-managed DISALLOW_FILE_EDIT definition to wp-config.php.
• Disable XML-RPC by returning HTTP 403 for WordPress XML-RPC requests and removing the X-Pingback header.
• Block PHP execution in uploads by adding marker-managed Apache rules to wp-content/uploads/.htaccess.
• Reversible changes that remove only plugin-owned marked blocks when a setting is disabled or the plugin is deactivated.
• Protected backups created before file changes. Backup payloads use a .php extension, an immediate exit, and Base64 encoding to prevent exposure through an Nginx reverse proxy.

Requirements

• WordPress 6.0 or newer
• PHP 7.4 or newer
• Apache must process .htaccess files for uploads protection

Installation

1. Download or clone this repository.
2. Place the plugin folder in wp-content/plugins/spry-simple-wp-security.
3. Activate Spry Simple WP Security in WordPress.
4. Open Settings → Spry Simple WP Security.
5. Enable the protections you want and save.

For a normal WordPress ZIP install, the ZIP should contain a top-level folder named spry-simple-wp-security.

HestiaCP, Nginx, and Apache

HestiaCP commonly places Nginx in front of Apache as a reverse proxy. The plugin does not edit Hestia templates or Nginx configuration because those files may be regenerated by Hestia.

The uploads protection is written to wp-content/uploads/.htaccess and is enforced by Apache after a request is proxied. Confirm that your Hestia web template passes matching requests to Apache and does not serve PHP-like files from uploads directly.

The XML-RPC protection runs inside WordPress and does not depend on Apache rules.

File safety

The plugin uses clearly labeled marker blocks:

/* BEGIN Spry Simple WP Security */
/* END Spry Simple WP Security */

# BEGIN Spry Simple WP Security
# END Spry Simple WP Security

On deactivation, only those marker blocks are removed. The plugin does not overwrite the complete current file with an older backup, which avoids destroying unrelated changes made after activation.

Protected backups are stored in:

wp-content/spry-simple-wp-security-backups/

Development

Run a syntax check locally:

php -l spry-simple-wp-security.php

The included GitHub Actions workflow checks the plugin against supported PHP versions.

License

GPL-2.0-or-later. See LICENSE.