Install
This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.
Install straight from GitHub with WP-CLI:
wp plugin install https://github.com/vegasgeek/lockdown-toolkit/archive/refs/heads/main.zipUpdates itself. It ships its own updater (Plugin Update Checker), so new versions appear under Dashboard → Updates.
Lockdown Toolkit by VegasGeek
A comprehensive WordPress plugin that provides essential hardening tools to protect your WordPress site from common security threats.
Features
1. REST Endpoint Hiding
Hide sensitive WordPress REST API endpoints from public access, preventing information disclosure and reducing your site's attack surface.
Automatically Hidden on Activation:
- /wp/v2/users - Prevents public enumeration of user accounts
- /wp/v2/media - Restricts public access to media library endpoints
How It Works:
- Blocks access to hidden endpoints with a 403 Forbidden response
- Completely transparent to site functionality
- Works with any REST endpoint
2. Hidden Login Page
Obscure your WordPress login page by moving it to a custom URL and redirecting direct access attempts to wp-login.php.
Configuration:
Located in Settings General under the "Hide Login Page" section.
Fields:
- Login Page URL - Set a custom path where your login form will be accessible (e.g., my-login)
- Format: https://yoursite.com/[your-path]
- Leave empty to disable
- Redirect URL - Where to send users who try to access wp-login.php directly (e.g., 404 or homepage)
- Format: https://yoursite.com/[