Security Hardener
Security Hardener applies WordPress security best practices based on the WordPress Advanced Administration / Security / Hardening documentation and widely accepted hardening measures. It uses WordPress core functions and follows best practices without modifying core files. Key Features File Security: * Disable file editor in WordPress admin * Optionally disable all file modifications XML-RPC Protection: * Disable XML-RPC completely * Remove pingback methods when XML-RPC is enabled Pingback Protection: * Disable self-pingbacks * Remove X-Pingback header * Block incoming pingbacks User Enumeration Protection: * Block /?author=N queries (returns 404) * Secure REST API user endpoints (require authentication) * Remove users from XML sitemaps * Prevent canonical redirects that expose usernames * Optionally block author feed pages (/author/username/feed/) * Optionally anonymize the author name in oEmbed responses Login Security: * Generic error messages (no username/password hints) * Login honeypot * Block unsafe usernames * Application Passwords disabled by default * IP-based rate limiting with configurable thresholds * Security event logging Security Headers: * X-Frame-Options: SAMEORIGIN (clickjacking protection) * X-Content-Type-Options: nosniff (MIME sniffing protection) * Referrer-Policy: strict-origin-when-cross-origin * Permissions-Policy (restricts geolocation, microphone, camera) * Optional HSTS (HTTP Strict Transport Security) for HTTPS sites — max-age set to 1 year Additional Hardening: * Hide WordPress version (meta generator tag and asset query strings) * Remove obsolete wp_head items (RSD, WLW manifest, shortlink, emoji scripts) * System Status — monitors file permissions, WP_DEBUG, user registration, PHP version, administrator accounts, and database version ⚠️ Important: Always test security settings in a staging environment first. Some features may affect third-party integrations or plugins. Privacy: This plugin does not send data to external services and does not create custom database tables. It stores plugin settings and a security event log in the WordPress options table, and uses transients for temporary login attempt tracking. All data is preserved on uninstall by default and only deleted if the “Delete all data on uninstall” option is explicitly enabled.
Protector – Malware Removal, Firewall & Core Repair
Every day, thousands of WordPress sites are hacked. Most security plugins offer protection, but they come with a massive cost: they slow down your server with bloated features and complex settings. Protector is different. It is a lightweight, AI-ready security layer that turns your WordPress site into a digital fortress without compromising speed. Whether you are trying to recover a hacked site or proactively defend your business, Protector delivers enterprise-grade security that anyone can configure. With our new 1-Click Security Overview Dashboard, you can activate all recommended protections and block 98% of automated attacks in under 8 seconds. 📖 Read the Official Documentation here 🦠 Malware Threat Scanner & Auto-Repair Don’t just find malware; destroy it. Our deep, recursive local scanner verifies your WordPress integrity without crashing your server: * Core Integrity Verification: Cross-references all Core files against the official WordPress.org checksums. * Advanced Pattern Detection: Detects suspicious code patterns (like eval, base64_decode, shell_exec) hidden in your files. * 1-Click Auto-Repair: Found a modified core file? Click “Repair” and Protector will automatically fetch a clean, original version directly from the official WP SVN and overwrite the infected file. 🛡️ Login Fortress (Brute-Force Protection) Hackers relentlessly target the wp-login.php page. We make it disappear. * Secret Login URL: Hide wp-login.php completely. Any unauthorized attempt will be instantly redirected to a custom URL of your choice. * Smart Honeypots: Inject invisible fields into your login and comment forms to trap and block spam/brute-force bots automatically. * Block Username Scanning: Prevent attackers from discovering your admin usernames via ?author=1 enumeration. 🔒 1-Click Site Hardening Lock down common vulnerabilities instantly: * Security Headers: Protect against XSS, Clickjacking, and MIME-Sniffing attacks with a single toggle. * XML-RPC Control: Disable XML-RPC completely to eliminate one of the biggest brute-force attack vectors on WordPress. * Version Obfuscation: Hide your WordPress version from the source code so hackers can’t target known exploits. * Restrict REST API: Block public access to endpoints that expose sensitive user data. 📊 Live Attack Log Peace of mind you can actually see. Monitor every blocked attack, triggered honeypot, and deleted malware in real-time straight from your dashboard. 🚀 Upgrade to KloxStudios Pro Need absolute maximum power? Protector integrates seamlessly with the KloxStudios Cloud AI. Pro users unlock Cloud AI Malware Verification for 3rd-party plugins/themes, Automatic IP Lockouts, Instant Admin Login Alerts (Email & Webhook), and 2FA.
