badegg

<p><strong>Hard Boiled Security</strong> stands in contrast to the many heavily marketed security plugins available for WordPress. Rather than providing a barrage of configuration options and intrusive prompts and upsells, we silently close the most common security vulnerabilities.</p>
<p>This plugin was inspired by many painful situations we helped people out of over the years and developed to help people who do not code secure websites their with minimal effort.</p>
<h3>Plugin Features</h3>
<ul>
<li>Zero configuration, hardens security just by activating</li>
<li>Disables all file editing within WordPress Admin.</li>
<li>Pingbacks and Trackbacks are disabled on all existing and future posts.</li>
<li>Prevents username exposure by ensuring their nice name, which is used in their profile URL and Rest API endpoint, is not their username. Those with the <code>list_users</code> capability can change this if needed.</li>
<li>Tested and working with <a href="https://roots.io/bedrock" rel="nofollow ugc">Roots.io’s Bedrock</a> directory structure as a mu-plugin.</li>
</ul>
<h3>Planned features</h3>
<p>There is more we can do to harden your WordPress website’s security. The features we will implement in the future will also be opinionated and require little to no configuration.<br />
– Block brute force attacks by limiting failed login attempts within a reasonable timeframe<br />
– Prevent email server spam and abuse by limiting password reset requests<br />
– Logging when brute force and spam prevention measures are triggered with optional opt-in email notifications</p>
<h3>Keep it secret, keep it safe</h3>
<p>This plugin is not a magic fix-all security solution. We don’t believe any plugin can do that.</p>
<p>Website security, regardless of platform, requires careful consideration around common security principles around access and permissions. Things like always using strong passwords, never reusing them across multiple websites, and limiting administrator accounts to those who actually need it. So many WordPress websites are compromised because administrator access is given out where the editor role is perfectly sufficient. Even if you are the website owner, using an editor account for your daily activities is a good idea.</p>
<h3>What to do to stay secure beyond using this plugin</h3>
<ul>
<li>Strong, unique, randomised passwords.</li>
<li>Fewer administrator accounts given only to those that need access to how the website works.</li>
<li>Use editor accounts or lower for regular content updates where possible.</li>
<li>Ensure the plugins and themes you use have been updated within the last few months.</li>
<li>Abandoned themes or plugins will not be updated if security vulnerabilities are found so replace them.</li>
</ul>
<h3>Why this plugin may not be for you</h3>
<p>This is an opinionated plugin built around our assumptions. These assumptions are based on our experiences over 15 years of building WordPress websites and may go against your workflow or philosophy.</p>
<p>One of the main reasons we wrote this plugin is to create an easy way for people to disable the built-in file editor in the WordPress admin. A compromised administrator account can easily add malicious code to any theme or plugin and it can be very difficult to detect and locate it. This is the main reason we disable this feature outright. Secondly, if you’re writing code, we consider it to be bad practice to edit files directly in a production environment (ie, a live website).</p>


Hard Boiled Security

A simple plugin that hardens some common Wordpress vulnerabilities

Amrit Anandh

Kuppuraj

infinitewp

<p><a href="https://infinitewp.com/" title="Manage Multiple WordPress" rel="nofollow ugc">InfiniteWP</a> allows users to manage unlimited number of WordPress sites from their own server.</p>
<p>Main features:</p>
<ul>
<li>Self-hosted system: Resides on your own server and totally under your control</li>
<li>One-click updates for WordPress, plugins and themes across all your sites</li>
<li>Instant backup and restore your entire site or just the database</li>
<li>One-click access to all WP admin panels</li>
<li>Bulk Manage plugins & themes: Activate & Deactive multiple plugins & themes on multiple sites simultaneously</li>
<li>Bulk Install plugins & themes in multiple sites at once</li>
<li>and more..</li>
</ul>
<p>Visit us at <a href="https://infinitewp.com/" title="Manage Multiple WordPress" rel="nofollow ugc">InfiniteWP.com</a>.</p>
<p>Check out the <a href="https://www.youtube.com/watch?v=s35ZoW95cnU" rel="nofollow ugc">InfiniteWP Overview Video</a> below.</p>
<p><span class="embed-youtube" style="text-align:center; display: block;"><iframe loading="lazy" class="youtube-player" width="750" height="422" src="https://www.youtube.com/embed/s35ZoW95cnU?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent" allowfullscreen="true" style="border:0;" sandbox="allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox"></iframe></span></p>
<p>Credits: <a href="http://prelovac.com/vladimir" rel="nofollow ugc">Vladimir Prelovac</a> for his worker plugin on which the client plugin is being developed.</p>


InfiniteWP Client

We have 100 sites that we manage, update, review and monitor on a daily, weekly and monthly basis for customers.  Infinitewp makes this so simple to manage.  You can instantly see needed updates, You can setup staging sites to manage updates before updating live sites which is essential for our highly custom ecommerce sites.  

Support is top notch.  We have had 2 issues.  One was a 2 second fix where we simply did not RTFM and missed the step.  The other issue was recent and had to do with the recent update in WP All in One Security in which a specific setting was blocking access.  The support team could have taken the easy way and said - this setting is blocking our access, you have to leave it unchecked and not use it, but the infinitewp team did things the right way and updated their plugins to work around the security setting.  

This plugin is well worth the price.  It saves us hours every week and we highly recommend. 

BEST tool for any wordpress dev who manages sites

I have been using InfiniteWP for years, and highly recommend. It provides a quick way to see what sites have updates, and a way to target updating only specific sites/plugins/core. I've tried others, like ManageWP, but they lack features I need, like being able to only update specific plugins, or get a list of all sites I just updated so I can log into each, and check the updates didn't break anything. Most of my clients' sites use WP Engine's Smart Plugin Manager, and I use InfiniteWP so I can ensure the automatic updates keep running (they've stopped on quite a few of my sites, and InfiniteWP is how I track when this happens so I can get the automatic updates running again). I have InfiniteWP set up to send me an email of all sites that have updates daily. Asvin has provided fast, awesome support anytime I've had an issue over the years - which has only happened a couple of times when dealing with more advanced settings.

A must-have to manage site updates

Install this plugin on unlimited sites and manage them all from a central dashboard. This plugin communicates with your InfiniteWP Admin Panel.

Hard Boiled Security vs InfiniteWP Client