keithlunt

Most security plugins try to do everything — firewall, blocking, malware scanning, email alerts — and end up bloated, slow, and full of upsells. Attack Monitor does one thing: it watches your site for common attack patterns and quietly logs them, so you always know what’s being thrown at your site. 
What it detects
Brute force login attempts 
XML-RPC abuse (including system.multicall floods) 
User enumeration via ?author= and the REST API 
Admin area probing by unauthenticated visitors 
Path and plugin scanning (phpinfo.php, .env, phpmyadmin, wp-config.php and more) 
SQL injection attempts in URLs and POST data 
XSS attempts in URLs and POST data 
Comment flooding
What you get
A dashboard widget showing this week’s attacks by category at a glance 
A full log page with day / week / 30-day / all-time views 
A bar chart of attack volume over time 
Top attacking IPs ranked by hit count 
Filterable event log with timestamps, IPs, URLs and detail 
Safe IP whitelist — exclude your own monitoring tools, cron jobs or office IP ranges 
CIDR range support (e.g. 192.168.1.0/24) for the whitelist 
A single lightweight database table — nothing else added to your WordPress installation
Philosophy 
Detection and blocking are separate concerns. This plugin handles detection only, leaving you free to choose how you respond — whether that’s Fail2ban, Cloudflare, a companion blocking plugin, or simply reviewing the data. No firewall rules are added, no requests are blocked or slowed down, and no data is sent anywhere outside your own database. 
Ideal for developers, agencies and site owners who want visibility without handing over control to an all-in-one security suite.

Janric Simple Attack Monitor

Lightweight attack detection for WordPress. Logs brute force, XML-RPC abuse, SQL injection, XSS attempts and more. No bloat, no blocking — just data.

Shah Alom

Micro Solutions Bangladesh

Basic Optimization provides simple on/off controls for common WordPress cleanup and performance-related tweaks. It is intentionally small, dependency-free, and designed for site owners who want practical optimization controls without a large performance suite.
The plugin adds a Basic Optimization admin screen where administrators can enable or disable each feature independently. It also includes a child Email Notifications settings page for disabling selected WordPress core auto emails.
<h4>Features</h4>
<ul>
<li>Disable Emojis – Removes WordPress emoji scripts, styles, filters, and emoji DNS prefetch output.</li>
<li>Remove Shortlink – Removes the shortlink tag from the document head.</li>
<li>Remove CSS/JS Version – Removes the <code>ver</code> query argument from enqueued stylesheet and script URLs.</li>
<li>Remove RSD Links – Removes the Really Simple Discovery link from the document head.</li>
<li>Disable Embeds – Removes WordPress oEmbed discovery links and dequeues the default <code>wp-embed</code> frontend script.</li>
<li>Disable XML-RPC – Disables XML-RPC requests and removes the <code>X-Pingback</code> response header.</li>
<li>Remove WLW Manifest Link – Removes the Windows Live Writer manifest link from the document head.</li>
<li>Disable Self Pingback – Prevents self pingbacks when content links to the same site.</li>
<li>Hide WordPress Version – Removes the WordPress generator meta tag from the document head.</li>
<li>Disable Heartbeat – Deregisters the WordPress heartbeat script on the frontend.</li>
<li>Email Notifications – Adds dropdown controls to disable selected WordPress core auto emails, including new user registration, password changed, comment moderation, and automatically approved comment notifications.</li>
</ul>
<h4>Notes</h4>
Some features can affect integrations that rely on WordPress defaults. For example, disabling XML-RPC can affect external publishing clients and services that still depend on XML-RPC. Disabling auto emails can also affect administrator awareness of user and comment activity. Disable only the features that match your site requirements.

Basic Optimization

A lightweight WordPress optimization plugin for disabling selected default frontend and header outputs such as emojis, shortlinks, embeds, XML-RPC, se …

Janric Simple Attack Monitor vs Basic Optimization