zackdesign

AliasIO

MJP Security Tools is a focused hardening plugin that does four things well:
<ul>
<li>XSS Database Scanner — scans every table for <code><script></code>, <code><iframe></code>, <code>onclick</code>, <code>javascript:</code> and other injection patterns</li>
<li>POST Request Log — records all POST data (passwords masked) with IP, user agent, and URL for CSRF/audit detection</li>
<li>Failed Login Log — tracks every failed login attempt with username, IP, and timestamp</li>
<li>File Permission Checker — verifies WordPress root files and directories have safe permissions, checks for missing <code>index.html</code> files and SVN working copies</li>
</ul>
What this plugin does NOT do (because WordPress core already handles it):
<ul>
<li>SSL enforcement — use <code>FORCE_SSL_ADMIN</code> or let WordPress 5.7+ auto-redirect</li>
<li>Password strength — WordPress core enforces strong passwords since 4.3</li>
<li>Login rate limiting — use a dedicated plugin like Limit Login Attempts Reloaded</li>
<li>Version number hiding — marginal benefit, not worth the complexity</li>
</ul>
Upgrading from v1.x:
<ul>
<li>The admin page has moved from jQuery UI tabs to native WordPress nav tabs</li>
<li>SSL forcing, password enforcement, login throttling, version hiding, admin username changing, database prefix randomization, password reset, and .htaccess generation have been removed — WordPress core and dedicated security plugins handle these better</li>
<li>PHP sessions replaced with WP transients for flash messages</li>
<li>Log data is now stored as JSON instead of serialized PHP</li>
<li>The Javacrypt client-side crypt(3) script has been removed</li>
</ul>

MJP Security Tools

Lightweight WordPress hardening — XSS database scanner, POST request logging, failed login logging, and file permission checker.

Jose Mortellaro

It helps in preventing Cross Site Scripting (XSS) with just a few lines of code.
Just activate it, no settings, no bloat.
It will not stop all the Cross Site Scripting injections, but with a very few lines of code you will drastically increase the security of your website without worsening the performance.
You can read more about what it does at <a href="https://josemortellaro.com/how-to-prevent-cross-site-scripting-xss/" rel="noopener nofollow ugc">https://josemortellaro.com/how-to-prevent-cross-site-scripting-xss/.</a>.
<h3>Help</h3>
If you need help open a thread on the support forum of this plugin. 
Please, before posting enable the debugging in wp-config.php. Need a step-by-step guide? Read <a href="https://freesoul-deactivate-plugins.com/how-to-enable-debugging-in-wordpress-a-step-by-step-guide/" rel="nofollow ugc">this detailed tutorial</a> on <a href="https://freesoul-deactivate-plugins.com/how-to-enable-debugging-in-wordpress-a-step-by-step-guide/" rel="nofollow ugc">how to enable debugging in WordPress</a> to learn more.

Basic Security: Prevent Cross Site Scripting

It helps in preventing Cross Site Scripting (XSS) with just a few lines of code.

MJP Security Tools vs Basic Security: Prevent Cross Site Scripting