WpIron

<p><strong>Iron Security</strong> is your WordPress security bodyguard.</p>
<p>It shields your site from brute force attacks, unauthorized admin access, file injections, and common exploits like XML-RPC and REST API abuse. Whether you’re a solo creator or managing client sites, Iron Security delivers essential protection without the performance hit.</p>
<p>🔒 <strong>Don’t wait until your site is compromised. Secure it now — effortlessly.</strong></p>
<p>Iron Security includes real-time brute-force protection, custom login URLs, HTTP headers, session control, malware upload prevention, and much more. All from a single, easy-to-use plugin dashboard.</p>
<p><strong>Protects Against:</strong><br />
– 🔐 Brute Force Attacks (Limit login attempts, 2FA)<br />
– 👮 Unauthorized Admin Access (Custom login URL, admin limit)<br />
– 👤 User Enumeration<br />
– 🎯 Admin Account Targeting (Admin ID & username protection)<br />
– 💣 XML-RPC & REST API Exploits<br />
– 🛡️ Code Injection & PHP Malware Uploads<br />
– 📂 Direct Access to Sensitive Files<br />
– 📛 MIME Sniffing & Content-Type Exploits<br />
– 🖼️ Clickjacking<br />
– 🧬 Cross-Site Scripting (XSS)<br />
– 🌐 Referrer Leakage</p>
<h3>🔐 Key Features</h3>
<h3>🛠 General Hardening</h3>
<ul>
<li>Disable XML-RPC & REST API</li>
<li>Hide WordPress & WooCommerce versions</li>
<li>Block AI & scraping bots</li>
<li>Disable file editor</li>
<li>Enable plugin & core auto-updates</li>
</ul>
<h3>🔍 Security Logs</h3>
<ul>
<li>View detailed logs of login attempts and alerts</li>
<li>Filter logs by IP, message, or date</li>
<li>Audit suspicious activity easily</li>
</ul>
<h3>🔑 Login & Authentication</h3>
<ul>
<li>Custom login/admin URL</li>
<li>Limit login attempts with lockouts</li>
<li>Session timeout for idle users</li>
<li>Limit number of administrators</li>
<li>Block user enumeration</li>
<li>Change default Admin ID and Username</li>
<li>Enable 2FA (Google Authenticator)</li>
</ul>
<h3>🗂 Files & Directory Protection</h3>
<ul>
<li>Block PHP file uploads</li>
<li>Prevent direct access to core/system files</li>
</ul>
<h3>📦 HTTP Security Headers</h3>
<ul>
<li>X-Content-Type-Options</li>
<li>X-Frame-Options</li>
<li>X-XSS-Protection</li>
<li>Strict-Transport-Security</li>
<li>Referrer-Policy</li>
<li>Content-Security-Policy</li>
<li>Permissions-Policy</li>
</ul>
<blockquote>
<p>Iron Security is built for creators who care about speed, simplicity, and security. If you’re not securing your site, you’re risking everything.</p>
</blockquote>
<h3>Credits</h3>
<p>Developed and maintained by <a href="https://wpiron.com" rel="nofollow ugc">WPIron</a></p>
<h3>License</h3>
<p>This plugin is licensed under the GPLv2 or later.</p>


Iron Security – WordPress Security Plugin

Hardening tool that blocks hackers and protect against: Brute Force Attacks, Exploits, Injections, Clickjacking and other important functionalities.

ArkHost

<p>A complete security plugin that’s actually free. No “pro” version, no nag screens, no made-up threat statistics.</p>
<h4>Login Protection</h4>
<ul>
<li>Blocks IPs after failed login attempts</li>
<li>Custom login URL (hides wp-login.php)</li>
<li>Hides wp-admin from logged-out users</li>
<li>Honeypot field for bots</li>
<li>Hides login errors (stops username enumeration)</li>
<li>Email alerts for admin logins from new IPs</li>
<li>Country/IP restrictions on login page</li>
</ul>
<h4>IP Control</h4>
<ul>
<li>Whitelist and blacklist</li>
<li>Auto-blacklist after repeated lockouts</li>
<li>IPv4, IPv6, CIDR supported</li>
</ul>
<h4>Geo Blocking</h4>
<ul>
<li>Block countries</li>
<li>Uses free IP2Location LITE database</li>
<li>One-click download</li>
</ul>
<h4>Hardening</h4>
<ul>
<li>Disable XML-RPC</li>
<li>Disable dashboard file editing</li>
<li>Disable application passwords</li>
<li>Restrict REST API to logged-in users</li>
<li>Remove WordPress version</li>
<li>Block user enumeration (?author=1 and REST API)</li>
<li>Disable pingbacks/trackbacks</li>
</ul>
<h4>Security Headers</h4>
<p>X-Content-Type-Options, X-Frame-Options, X-XSS-Protection, Referrer-Policy, Permissions-Policy, Content-Security-Policy, HSTS</p>
<h4>Two-Factor Authentication</h4>
<ul>
<li>TOTP (Google Authenticator, Authy, etc.)</li>
<li>Backup codes</li>
<li>Enforce for admins</li>
</ul>
<h4>File Integrity Monitoring</h4>
<ul>
<li>Checks WordPress core files against official checksums</li>
<li>Daily scans</li>
<li>Email alerts on changes</li>
</ul>
<h4>Malware Scanner</h4>
<ul>
<li>Scans plugins, themes, uploads</li>
<li>Pattern-based detection</li>
<li>Quarantine suspicious files</li>
<li>Weekly scans</li>
</ul>
<h4>Activity Log</h4>
<ul>
<li>Login attempts, lockouts, blocks</li>
<li>IP, country, username, timestamp</li>
<li>Configurable retention</li>
<li>CSV export</li>
</ul>
<h4>Tools</h4>
<ul>
<li>Export/import settings</li>
<li>Force logout all users</li>
<li>Test email</li>
<li>Delete readme.html/license.txt</li>
</ul>
<h4>Privacy</h4>
<p>No tracking. No analytics. No telemetry.</p>
<p>External connections:<br />
* WordPress.org API (core file checksums)<br />
* IP2Location (database download, only when you click it)</p>
<h3>External services</h3>
<p>This plugin connects to the following external services under specific circumstances:</p>
<h4>WordPress.org Checksums API</h4>
<ul>
<li>Service: api.wordpress.org/core/checksums/1.0/</li>
<li>Used for: Verifying WordPress core file integrity by comparing local files against official checksums</li>
<li>Data sent: WordPress version and locale</li>
<li>When: During daily scheduled file integrity scans and when manually triggered by the admin</li>
<li>Privacy policy: https://wordpress.org/about/privacy/</li>
</ul>
<h4>IP Detection Services</h4>
<ul>
<li>Services: api.ipify.org, ifconfig.me, icanhazip.com</li>
<li>Used for: Detecting the server’s public IP address for the “Whitelist My IP” tool</li>
<li>Data sent: Standard HTTP request (no personal data)</li>
<li>When: Only when an admin uses the “Whitelist My IP” feature in the Tools tab</li>
<li>Terms: https://www.ipify.org/ / https://ifconfig.me/ / https://icanhazip.com/</li>
</ul>
<h4>IP2Location</h4>
<ul>
<li>Service: download.ip2location.com</li>
<li>Used for: Downloading the free IP2Location LITE geolocation database for country-based blocking</li>
<li>Data sent: Standard HTTP request (optional: user’s download token if configured)</li>
<li>When: Only when an admin clicks “Download IP2Location Database” in the IP Control tab</li>
<li>Terms of service: https://www.ip2location.com/terms</li>
<li>Privacy policy: https://www.ip2location.com/privacy</li>
</ul>


ArkHost Security Pack

WordPress security without the nonsense. No upsells, no premium tier, no fake threat counters.

Iron Security – WordPress Security Plugin vs ArkHost Security Pack