WP Manifestindependent plugin directory
manifest / security / kirito

Kirito

Defensive security toolkit for WordPress Blue Teams: hardening audit, core checksum verification, firewall, custom rules, TOTP 2FA, and audit logging.

by Muhammad Zakir Ramadhan · github.com/zakirkun/kirito · website

★ 0stars
0forks

Install

No release zip yet. The repository archive installs, but the folder name will carry the branch suffix and updates will not flow:

wp plugin install https://github.com/zakirkun/kirito/archive/refs/heads/main.zip
Readme github.com/zakirkun/kirito ↗

A defensive security toolkit for WordPress Blue Teams. Audit hardening, verify core file integrity against WordPress.org, block hostile traffic at the application layer, and enforce two-factor authentication.

Built for defense. It reports, it blocks, and it never phones home.

  • Author: Muhammad Zakir Ramadhan
  • Requires: WordPress 6.0+, PHP 7.4+
  • License: GPLv2 or later

What it does

Area Detail
Hardening audit PHP/WP versions, WP_DEBUG, DISALLOW_FILE_EDIT, DB prefix, default admin user, SSL, file permissions
Core checksums Every core file compared against official WordPress.org checksums — catches tampering that predates installation
File integrity MD5 baseline of wp-admin + wp-includes, hourly cron diff, email/webhook alert on drift
Malware scan 13 heuristic signatures across core, plugins and themes
Firewall Signature scoring, rate limits, escalating bans, IP/CIDR allow & block lists
Custom rules Target + operator + pattern + action, with a live tester and regex safety guards
2FA TOTP (RFC 6238) with backup codes, email OTP fallback
Sessions Active session counts, force logout
Audit log Filterable, searchable, CSV export, retention policy
Country rules Allow/block by ISO country code, when a GeoIP backend is present
Security headers nosniff, frame options, referrer policy, HSTS, and CSP in report-only

Install

cd wp-content/plugins
git clone https://github.com/zakirkun/kirito.git

Activate in Plugins, then open the Kirito menu.

Before you enable blocking

Two safeguards exist for a reason. Read them before writing your first blocking rule.

Put your own IP in the allowlist first. An allowlist entry always beats the firewall and every ban, so no rule can lock you out. Settings → IP allowlist.

Know the kill switch. Create wp-content/kirito-off.php (any content) or add define( 'KIRITO_DISABLED', true ); to wp-config.php, and all blocking stops immediately. You can create that file over SFTP even when every page returns 403. This is the recovery path when an aggressive rule goes wrong.

Delete the file to re-enable.

Approach

It never guesses. Country blocking needs a GeoIP database, and there is no honest way to invent one. Kirito reads from MaxMind GeoLite2 (via the GeoIP Detect plugin or the PECL extension) and reports "unknown" when no backend is present. The setting is visibly disabled rather than silently ignored.

It fails open on rules it cannot evaluate. Every custom regex runs under a pcre.backtrack_limit ceiling. A pattern that exceeds it is treated as a non-match, never as a block. Kirito will not take a site down over a rule it could not evaluate.

It refuses to write server config. The PHP-execution guard for wp-content is generated for you to apply, never written automatically — a malformed .htaccess is a 500 with no admin left to fix it from.

It does not claim to stop DDoS. This is application-layer abuse control: credential stuffing, scanners, bad bots, request floods against PHP. A volumetric attack exhausts the server before PHP executes, so this code never runs during one. Edge filtering is the only thing that helps there.

Testing

No WordPress or database needed. Run from the plugin directory:

php tests/totp-vectors.php     # RFC 6238 vectors, base32, drift window
php tests/firewall-check.php   # CIDR v4/v6, XFF trust, signatures
php tests/rules-check.php      # operators, regex safety, rule selection
php tests/wiring-check.php     # duplicate defs, unresolved calls, hooks

wiring-check.php is worth running after any change: it catches a hook callback that no longer resolves, which is how a security feature silently stops working.

Layout

kirito.php              bootstrap: constants, requires, activation
includes/
  helpers.php           settings, alerting, CIDR
  log.php               audit table
  auth.php              allowlist, lockout, 2FA gate
  totp.php              RFC 6238 + backup codes
  fim.php               baseline + cron
  checksums.php         core verification vs WordPress.org
  malware.php           signatures
  firewall.php          request inspector
  rules.php             custom rule engine
  rules-admin.php       rule UI + tester
  rules-guide.php       in-admin guide
  geoip.php             country resolution
  hardening.php         PHP-execution guard
  headers.php           security headers
  admin.php             menu, handlers, summary
  render.php            page rendering
  profile.php           per-user 2FA enrolment
tests/                  standalone checks, no WordPress needed

License

GPLv2 or later. See LICENSE.