reinajhon46

JR Security Hardening and Login Protection secures your WordPress installation at the application level with one-click hardening modules. Designed to be secure by default and Cloudflare compatible.
Included modules:
<ul>
<li>Disable XML-RPC — Full block (filter + hard block) to prevent brute force attacks and pingback DDoS.</li>
<li>Hide WordPress version — Removes version from generator meta and CSS/JS assets.</li>
<li>Disable file editor — Prevents theme and plugin editing from the admin panel (DISALLOW_FILE_EDIT).</li>
<li>Disable emojis — Removes WordPress emoji scripts and styles, improving performance.</li>
<li>Block user enumeration (?author= and /author/) — Dual-layer protection against username discovery.</li>
<li>Block REST enumeration (wp-json users) — Prevents enumeration via the WordPress REST API.</li>
<li>Block sensitive paths/files — Blocks access to readme.html, license.txt, .env, .git, composer.json, etc. (only what passes through WordPress).</li>
<li>Security headers — X-Content-Type-Options, Referrer-Policy, Permissions-Policy, X-Frame-Options, HSTS (HTTPS only) and removal of technology-revealing headers.</li>
<li>Login protection — Rate limiting by IP and by user+IP with configurable temporary lockout.</li>
<li>IP whitelist — Excludes trusted IPs from rate limiting to avoid accidental lockouts.</li>
<li>Email notification — Receive an email when an IP is locked out due to too many failed login attempts.</li>
<li>Activity log — Security event logging in a dedicated database table with configurable retention and automatic cleanup via cron.</li>
<li>Ready-to-use server rules — Code for Apache (.htaccess) and Nginx to block static files that WordPress cannot reach.</li>
</ul>
Smart IP detection:
<ul>
<li>Native support for Cloudflare (CF-Connecting-IP).</li>
<li>Option to trust X-Forwarded-For / X-Real-IP behind trusted proxies.</li>
<li>Fallback to REMOTE_ADDR.</li>
</ul>
Clean uninstall:
When the plugin is deleted, all options, the events table and transients are removed. No data is left behind in your database.

JR Security Hardening and Login Protection

WordPress hardening and login protection: security headers, enumeration blocking, rate limiting, IP whitelist, event logging and server rules.

wtbplugins

WTB Firewall is a lightweight but powerful WordPress firewall plugin designed to help you protect your site from unwanted visitors, brute-force attacks and malicious traffic.
The plugin allows you to define clear access rules, automatically block suspicious behaviour, and correctly detect real visitor IP addresses even when your site is behind a proxy or CDN.
<h4>Core Features</h4>
<ul>
<li>Manual IP allow and block rules</li>
<li>Country-based access control</li>
<li>Automatic blocking after repeated authentication failures</li>
<li>Built-in rate limiting to protect your site from excessive requests and abuse</li>
<li>404 monitoring to detect and block traffic generating repeated missing-page errors</li>
<li>Proxy support with trusted header detection</li>
<li>Lightweight design with minimal performance impact</li>
<li>Clean WordPress-native admin interface</li>
</ul>
<h4>Why use WTB Firewall?</h4>
Many WordPress security plugins include dozens of features that add complexity and overhead. WTB Firewall focuses on essential firewall functionality so you can:
<ul>
<li>Stop brute-force login attempts</li>
<li>Restrict access from unwanted regions</li>
<li>Block abusive visitors quickly</li>
<li>Ensure accurate IP detection behind proxies or CDNs</li>
<li>Keep your site fast while improving security</li>
</ul>
<h4>Designed for Performance</h4>
WTB Firewall is built with performance and reliability in mind. Rules are processed efficiently, unnecessary background tasks are avoided, and the plugin integrates cleanly with WordPress without slowing down your site.

WTB Firewall

Easy to use Firewall for securing your site. IP blocking, geo blocking, brute-force protection and rate limiting.

JR Security Hardening and Login Protection vs WTB Firewall