zackdesign

AliasIO

MJP Security Tools is a focused hardening plugin that does four things well:
<ul>
<li>XSS Database Scanner — scans every table for <code><script></code>, <code><iframe></code>, <code>onclick</code>, <code>javascript:</code> and other injection patterns</li>
<li>POST Request Log — records all POST data (passwords masked) with IP, user agent, and URL for CSRF/audit detection</li>
<li>Failed Login Log — tracks every failed login attempt with username, IP, and timestamp</li>
<li>File Permission Checker — verifies WordPress root files and directories have safe permissions, checks for missing <code>index.html</code> files and SVN working copies</li>
</ul>
What this plugin does NOT do (because WordPress core already handles it):
<ul>
<li>SSL enforcement — use <code>FORCE_SSL_ADMIN</code> or let WordPress 5.7+ auto-redirect</li>
<li>Password strength — WordPress core enforces strong passwords since 4.3</li>
<li>Login rate limiting — use a dedicated plugin like Limit Login Attempts Reloaded</li>
<li>Version number hiding — marginal benefit, not worth the complexity</li>
</ul>
Upgrading from v1.x:
<ul>
<li>The admin page has moved from jQuery UI tabs to native WordPress nav tabs</li>
<li>SSL forcing, password enforcement, login throttling, version hiding, admin username changing, database prefix randomization, password reset, and .htaccess generation have been removed — WordPress core and dedicated security plugins handle these better</li>
<li>PHP sessions replaced with WP transients for flash messages</li>
<li>Log data is now stored as JSON instead of serialized PHP</li>
<li>The Javacrypt client-side crypt(3) script has been removed</li>
</ul>

MJP Security Tools

Lightweight WordPress hardening — XSS database scanner, POST request logging, failed login logging, and file permission checker.

Jay Suthar

BoundaryGuard Headers enforces modern HTTP security headers to harden your WordPress site against XSS, clickjacking, mixed content, and cross-origin attacks.
Key Features:
<ul>
<li>Essential Protection: Adds X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy to reduce attack surface and prevent clickjacking.</li>
<li>HSTS (Strict Transport Security): Forces HTTPS connections to help prevent protocol downgrade and man-in-the-middle attacks.</li>
<li>Advanced Isolation (COOP/COEP): Enables Cross-Origin-Opener-Policy and Cross-Origin-Embedder-Policy to improve cross-origin isolation and mitigate certain side-channel attacks.</li>
<li>Content Security Policy (CSP): One of the strongest defenses against XSS. Includes a dashboard-based CSP builder with preset options to whitelist trusted sources for scripts, styles, images, and more.</li>
<li>CSP Report-Only Mode: Test your policy safely without blocking content.</li>
<li>Server Header Hardening: Removes or limits exposure of headers such as <code>X-Powered-By</code> and <code>Server</code>.</li>
<li>Lightweight and Fast: Uses PHP headers for broad server compatibility and minimal performance impact.</li>
<li>No <code>.htaccess</code> Editing Required: Works without modifying server configuration files.</li>
</ul>
Designed for developers and site owners who want stronger security without unnecessary complexity.
<h3>External Services</h3>
This plugin provides a Content Security Policy (CSP) builder. To assist users, it includes “Preset Buttons” that allow users to quickly add domain names to their own CSP whitelist.
This plugin DOES NOT connect to, load data from, or send data to these services automatically. The following third-party domains are referenced as presets within the admin dashboard for whitelisting purposes: 
* Google Analytics (www.google-analytics.com) – Used for tracking whitelisting. [Privacy: https://policies.google.com/privacy] 
* Google Tag Manager (www.googletagmanager.com) – Used for tag management. [Privacy: https://policies.google.com/privacy] 
* Stripe (js.stripe.com, api.stripe.com) – Used for payment processing. [Privacy: https://stripe.com/privacy] 
* Facebook (www.facebook.com, connect.facebook.net) – Used for social embeds. [Privacy: https://www.facebook.com/policy.php] 
* YouTube (www.youtube.com, i.ytimg.com) – Used for video embeds. [Privacy: https://policies.google.com/privacy] 
* Vimeo (player.vimeo.com) – Used for video embeds. [Privacy: https://vimeo.com/privacy] 
* Gravatar (secure.gravatar.com) – Used for user avatars. [Privacy: https://automattic.com/privacy/]

BoundaryGuard Headers

Automatically enforces essential HTTP security headers to protect your site from XSS, clickjacking, and protocol downgrade attacks.

MJP Security Tools vs BoundaryGuard Headers