Lightweight WordPress hardening — XSS database scanner, POST request logging, failed login logging, and file permission checker.

zackdesign

AliasIO

MJP Security Tools is a focused hardening plugin that does four things well:
<ul>
<li>XSS Database Scanner — scans every table for <code><script></code>, <code><iframe></code>, <code>onclick</code>, <code>javascript:</code> and other injection patterns</li>
<li>POST Request Log — records all POST data (passwords masked) with IP, user agent, and URL for CSRF/audit detection</li>
<li>Failed Login Log — tracks every failed login attempt with username, IP, and timestamp</li>
<li>File Permission Checker — verifies WordPress root files and directories have safe permissions, checks for missing <code>index.html</code> files and SVN working copies</li>
</ul>
What this plugin does NOT do (because WordPress core already handles it):
<ul>
<li>SSL enforcement — use <code>FORCE_SSL_ADMIN</code> or let WordPress 5.7+ auto-redirect</li>
<li>Password strength — WordPress core enforces strong passwords since 4.3</li>
<li>Login rate limiting — use a dedicated plugin like Limit Login Attempts Reloaded</li>
<li>Version number hiding — marginal benefit, not worth the complexity</li>
</ul>
Upgrading from v1.x:
<ul>
<li>The admin page has moved from jQuery UI tabs to native WordPress nav tabs</li>
<li>SSL forcing, password enforcement, login throttling, version hiding, admin username changing, database prefix randomization, password reset, and .htaccess generation have been removed — WordPress core and dedicated security plugins handle these better</li>
<li>PHP sessions replaced with WP transients for flash messages</li>
<li>Log data is now stored as JSON instead of serialized PHP</li>
<li>The Javacrypt client-side crypt(3) script has been removed</li>
</ul>

Alternatives to MJP Security Tools

Top alternatives