BlueCrocus Security

BlueCrocus Security WordPress security plugin that protects against user enumeration, brute force attacks, and form spam. Features Brute Force Protection Blocks brute force attacks across all three WordPress authentication vectors: | Vector | Method | Protection | |--------|--------|------------| | wp-login.php | POST with log + pwd | IP rate limit — 5 attempts, 15min lockout | | XML-RPC | wp.getUsersBlogs via xmlrpc.php | Disabled entirely | | JWT Auth | POST to /wp-json/jwt-auth/v1/token | IP rate limit — shared with wp-login | How it works: - After 5 failed login attempts, the IP is locked out for 15 minutes - The counter is shared between wp-login and JWT (failures on one count toward the other) - Responds with HTTP 429 (Too Many Requests) and Retry-After header - Successful login clears the counter automatically Why is XML-RPC disabled entirely? XML-RPC supports system.multicall, which allows testing hundreds of passwords in a single HTTP request. Per-request rate limiting is insufficient — an attacker can send 500 passwords per request. The only effective protection is disabling the endpoint. User Enumeration Protection Prevents attackers from discovering valid user