REST & Login Shield WP Registry grade A. No security issues foundWP RegistryNo security issues foundOpen the reportA
Minimal WordPress security plugin: blocks REST API user enumeration, hides server metadata, and protects wp-login.php against brute force attacks.
Install
Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.
Install straight from GitHub with WP-CLI:
wp plugin install https://github.com/weblixpl/rest-login-shield/releases/download/v1.3.0/rest-login-shield-1.3.0.zipMinimal WordPress security plugin that blocks REST API user enumeration, hides server metadata, and protects wp-login.php against brute force attacks.
What it does
| Protection | Effect |
|---|---|
| REST API user enumeration | /wp-json/wp/v2/users/ returns 404 for unauthenticated requests |
| REST API metadata | Strips description, gmt_offset, timezone_string from /wp-json/ |
| Author enumeration | ?author=N is redirected (301) to the home page |
| Brute force protection | Configurable IP lockout after N failed logins, with CIDR whitelist |
Each protection can be toggled independently in Settings → REST & Login Shield.
Installation
Manual (single site)
- Download the latest release ZIP.
- WordPress admin → Plugins → Add New → Upload Plugin → choose the ZIP → Install & Activate.
- Configure under Settings → REST & Login Shield.
Bulk deployment (WP Toolkit / cPanel / Plesk)
- Upload the ZIP to WP Toolkit's plugin library.
- Select multiple sites → Install plugin → REST & Login Shield.
- Defaults are safe (all four protections enabled, 5 attempts / 30 min lockout) — no per-site configuration needed unless you want to add IP whitelists.
Automatic updates
The plugin uses plugin-update-checker to receive updates from GitHub releases. When a new version is tagged, every installation will show an update notification in the WordPress admin within 12 hours — identical UX to plugins from wordpress.org.
Releasing a new version (maintainer workflow)
# Bump version in rest-login-shield.php and readme.txt
git commit -am "Release vX.Y.Z"
git tag vX.Y.Z
git push && git push --tags
# On GitHub, create a Release from the tag (optional, but recommended for release notes)Settings
- Enable/disable each protection independently
- Max failed attempts (1–50)
- Lockout duration in minutes (1–1440)
- IP whitelist — one entry per line, supports IPv4, IPv6, and CIDR (e.g.
192.168.1.0/24). Lines starting with#are treated as comments. - Currently blocked IPs — table with one-click unblock
- Recent failed attempts — log of last 50 failed logins
Requirements
- WordPress 5.8+
- PHP 7.4+
Languages
English (default), Polish, Danish, German, Czech, Slovak, French.
License
GPL-2.0-or-later
Releases
6 releases. Each count is every asset in that release; expand a row for the breakdown.