reinajhon46

JR Security Hardening and Login Protection secures your WordPress installation at the application level with one-click hardening modules. Designed to be secure by default and Cloudflare compatible.
Included modules:
<ul>
<li>Disable XML-RPC — Full block (filter + hard block) to prevent brute force attacks and pingback DDoS.</li>
<li>Hide WordPress version — Removes version from generator meta and CSS/JS assets.</li>
<li>Disable file editor — Prevents theme and plugin editing from the admin panel (DISALLOW_FILE_EDIT).</li>
<li>Disable emojis — Removes WordPress emoji scripts and styles, improving performance.</li>
<li>Block user enumeration (?author= and /author/) — Dual-layer protection against username discovery.</li>
<li>Block REST enumeration (wp-json users) — Prevents enumeration via the WordPress REST API.</li>
<li>Block sensitive paths/files — Blocks access to readme.html, license.txt, .env, .git, composer.json, etc. (only what passes through WordPress).</li>
<li>Security headers — X-Content-Type-Options, Referrer-Policy, Permissions-Policy, X-Frame-Options, HSTS (HTTPS only) and removal of technology-revealing headers.</li>
<li>Login protection — Rate limiting by IP and by user+IP with configurable temporary lockout.</li>
<li>IP whitelist — Excludes trusted IPs from rate limiting to avoid accidental lockouts.</li>
<li>Email notification — Receive an email when an IP is locked out due to too many failed login attempts.</li>
<li>Activity log — Security event logging in a dedicated database table with configurable retention and automatic cleanup via cron.</li>
<li>Ready-to-use server rules — Code for Apache (.htaccess) and Nginx to block static files that WordPress cannot reach.</li>
</ul>
Smart IP detection:
<ul>
<li>Native support for Cloudflare (CF-Connecting-IP).</li>
<li>Option to trust X-Forwarded-For / X-Real-IP behind trusted proxies.</li>
<li>Fallback to REMOTE_ADDR.</li>
</ul>
Clean uninstall:
When the plugin is deleted, all options, the events table and transients are removed. No data is left behind in your database.

JR Security Hardening and Login Protection

WordPress hardening and login protection: security headers, enumeration blocking, rate limiting, IP whitelist, event logging and server rules.

learnhowwp

Login Gatekeeper adds an extra layer of security to your WordPress login page by requiring a custom key and value in the login URL (e.g. <code>/wp-login.php?secret=myvalue</code>). You can restrict which user roles require the key, helping to prevent brute force and bot login attempts.
Stealth Protection: 
The plugin does not modify the appearance or behavior of the default WordPress login page. Anyone accessing the login page without the correct secret and value will see the standard WordPress error message, even if they enter the correct username and password. This means attackers cannot detect that extra protection is in place.
Easily configure your login key, value, and restricted roles from the WordPress admin settings page. The plugin also includes a risk confirmation step to prevent accidental lockout.
Lost your secret or value? 
If you forget your login key or value, you can use the default WordPress “Lost your password?” feature. The secret key and value will be included in the password reset email, allowing you to regain access without needing to disable the plugin.
Features:
<ul>
<li>Require a custom key/value in the login URL</li>
<li>Restrict login by user role</li>
<li>Easy-to-use settings page</li>
<li>Prevents brute force and bot login attempts</li>
<li>No visible changes to the login page for added stealth</li>
<li>Secret and value included in password reset email if forgotten</li>
</ul>
Check Out Our Other Plugins
<ul>
<li><a href="https://wordpress.org/plugins/contact-form-db-divi/" rel="ugc">Divi Contact Form DB</a></li>
<li><a href="https://wordpress.org/plugins/overlay-image-divi-module/" rel="ugc">Divi Overlay on Images Module</a></li>
<li><a href="https://wordpress.org/plugins/post-carousel-divi/" rel="ugc">Divi Post Carousel Module</a></li>
<li><a href="https://wordpress.org/plugins/menu-cart-divi/" rel="ugc">Divi Menu Cart Module</a></li>
<li><a href="https://wordpress.org/plugins/flip-cards-module-divi/" rel="ugc">Divi Flip Cards Module</a></li>
<li><a href="https://wordpress.org/plugins/image-carousel-divi/" rel="ugc">Divi Image Carousel</a></li>
<li><a href="https://wordpress.org/plugins/breadcrumbs-divi-module/" rel="ugc">Divi Breadcrumbs Module</a></li>
</ul>

Login Gatekeeper

Protect your login page by requiring a secret key and value in the login URL.

JR Security Hardening and Login Protection vs Login Gatekeeper