John Godley

HTML Purified replaces the default WordPress comments filters with HTML Purifier, a super HTML filtering 
library.
<blockquote>
HTML Purifier is a standards-compliant HTML filter library written in PHP. HTML Purifier will 
 not only remove all malicious code (better known as XSS) with a thoroughly audited, secure yet 
 permissive whitelist, it will also make sure your documents are standards compliant, something 
 only achievable with a comprehensive knowledge of W3C’s specifications.
</blockquote>
An additional feature of HTML Purifier is that it will produce valid well-formed XHTML code, something 
which KSES does not do.
Features:
<ul>
<li>Configurable KSES or HTML Purifier</li>
<li>Configurable list of HTML elements and attributes for both KSES and HTML purifier</li>
<li>Additionally process comments with HTML Tidy</li>
<li>URL blacklist</li>
<li>Fully localized (and awaiting translations)</li>
<li>Automatically escape PHP or anything inside backticks</li>
</ul>
HTML Purifier is available in:
<ul>
<li>English</li>
<li>Spanish, thanks to José Cuesta</li>
<li>Belorussian, thanks to Marcis Gasuns</li>
<li>Russian, thanks to Ilyuha</li>
<li>Uzbekistan, thanks to Alexandra Bolshova</li>
<li>Dutch, thanks to Pieter</li>
<li>German, thanks to Andreas Beraz</li>
<li>Polish, thanks to Kasia Ciszewski & Dawid Śpiechowicz</li>
<li>Romanian, thanks to Alina @ InboxTranslations.com</li>
<li>Lithuanian, thanks to Nata Strazda</li>
<li>Ukranian, thanks to Iflexion Design</li>
</ul>
<h3>Documentation</h3>
Full documentation can be found on the <a href="http://urbangiraffe.com/plugins/html-purified/" rel="nofollow ugc">HTML Purified</a> page.

HTML Purified

HTML Purified replaces the default comments filters with the more secure HTML Purifier.

zackdesign

AliasIO

MJP Security Tools is a focused hardening plugin that does four things well:
<ul>
<li>XSS Database Scanner — scans every table for <code><script></code>, <code><iframe></code>, <code>onclick</code>, <code>javascript:</code> and other injection patterns</li>
<li>POST Request Log — records all POST data (passwords masked) with IP, user agent, and URL for CSRF/audit detection</li>
<li>Failed Login Log — tracks every failed login attempt with username, IP, and timestamp</li>
<li>File Permission Checker — verifies WordPress root files and directories have safe permissions, checks for missing <code>index.html</code> files and SVN working copies</li>
</ul>
What this plugin does NOT do (because WordPress core already handles it):
<ul>
<li>SSL enforcement — use <code>FORCE_SSL_ADMIN</code> or let WordPress 5.7+ auto-redirect</li>
<li>Password strength — WordPress core enforces strong passwords since 4.3</li>
<li>Login rate limiting — use a dedicated plugin like Limit Login Attempts Reloaded</li>
<li>Version number hiding — marginal benefit, not worth the complexity</li>
</ul>
Upgrading from v1.x:
<ul>
<li>The admin page has moved from jQuery UI tabs to native WordPress nav tabs</li>
<li>SSL forcing, password enforcement, login throttling, version hiding, admin username changing, database prefix randomization, password reset, and .htaccess generation have been removed — WordPress core and dedicated security plugins handle these better</li>
<li>PHP sessions replaced with WP transients for flash messages</li>
<li>Log data is now stored as JSON instead of serialized PHP</li>
<li>The Javacrypt client-side crypt(3) script has been removed</li>
</ul>

MJP Security Tools

Lightweight WordPress hardening — XSS database scanner, POST request logging, failed login logging, and file permission checker.

HTML Purified vs MJP Security Tools