Mirco Babini

Alfio Piccione

Andrea Capone

Babini Mazzari

NIS2 provides activity logging, file integrity monitoring, access protection and vulnerability scanning to help sites comply with the EU NIS2 directive.
<h3>NIS2 Compliance: The 1st WordPress NIS2 Plugin</h3>
NIS2 is the second iteration of the EU’s Network and Information Security (NIS) directive, a primary cybersecurity law that expands the scope of the original NIS directive to cover more sectors and entities, such as energy, transport, banking, healthcare, and digital infrastructure.
The directive mandates stricter security requirements, includes supply chain security, and assigns personal accountability to management for non-compliance.
<h3>Quick and easy setup</h3>
Choose which modules you want to enable, configure their settings and start monitoring your site in minutes.
Available modules are: 
– Activity Logger: logs important events such as user logins, content changes, plugin/theme installations and more. 
– File Integrity Monitoring: monitors core WordPress files, themes and plugins for unauthorized changes. 
– Access Protection: protects login and admin pages with Google reCAPTCHA v2 and limits access 
– Vulnerability Scanner: scans installed plugins and themes for known vulnerabilities using the WPScan database. 
– Compliance Checklist: provides a checklist of security best practices to help you improve your site’s security posture
<h3>Third party services</h3>
This plugin relies on the following third-party/external services:
Google reCAPTCHA v2 
Used to protect the WordPress login forms against automated abuse and spam. 
– Data sent: when a user interacts with the login form, the plugin loads the reCAPTCHA JavaScript API and sends the user’s IP address and form interaction data to Google’s reCAPTCHA service in order to validate the request. 
– Service provider: Google LLC 
– Terms of Service: https://www.google.com/intl/en/policies/terms/ 
– Privacy Policy: https://policies.google.com/privacy
IP-API.com 
Used to perform basic geolocation based on the visitor’s IP address (e.g., country, city, ISP). 
– Data sent: the visitor’s public IP address is queried against the ip-api.com service. No additional personal or sensitive data is transmitted. 
– Service provider: IP-API.com 
– Terms of Service: https://ip-api.com/docs/legal 
– Privacy Policy: https://ip-api.com/docs/legal
<h3>F.A.Q.</h3>
Does the plugin conflict with security plugins? 
No. NIS2 detects other popular security plugins and integrates with them when possible.

NIS2 Compliance

A comprehensive security compliance plugin implementing logging, monitoring and vulnerability management features.

Cornelius Bergen

Gauntlet Security can find opportunities for improving the security of your site. It checks many aspects of the site’s configuration including file permissions, server software, PHP, database, plugins, themes, and user accounts. The plugin will give each check a pass, warning, or fail and explain in clear language how you can fix the issue.
How you ultimately choose to patch these issues is up to you but whatever method you use, this plugin should always provide an accurate report. It does not make changes to your database or to any of your files and it should be compatible with all other security plugins.
Checks and recommendations include:
<ul>
<li>Set correct file and directory permissions</li>
<li>Turn off directory indexing</li>
<li>Prevent code execution in the uploads directory</li>
<li>Block files in the includes directory</li>
<li>Prevent access to stray files which could be useful to attackers</li>
<li>Keep PHP up-to-date</li>
<li>Disable dangerous PHP functions</li>
<li>Disable allow_url_include and allow_url_fopen PHP flags</li>
<li>Turn off the display of PHP errors</li>
<li>Don’t advertise the PHP version you are running</li>
<li>Use a strong database password</li>
<li>Change the default database table prefix</li>
<li>Keep WordPress up-to-date</li>
<li>Turn off file editing in the control panel</li>
<li>Set security keys in WP-Config file</li>
<li>Don’t advertise the WordPress version you are running</li>
<li>Turn off self-registration</li>
<li>Force SSL when accessing the admin area</li>
<li>Review the development activity and reputation of all plugins</li>
<li>Remove unused themes from the server</li>
<li>Rename the plugin directory</li>
<li>Move the active theme to an alternate location</li>
<li>Do not use TimThumb</li>
<li>Do not use common user names (such as “admin”)</li>
<li>Do not use weak passwords</li>
<li>Do not have a user with an ID = 1</li>
<li>Minimize the number of admin users</li>
<li>Users should not display their login usernames publicly</li>
<li>Prevent username enumeration through standard author URLs</li>
<li>…more tests planned</li>
</ul>
Check the <a href="screenshots" rel="nofollow ugc">screenshots</a> for more detail on some of the above features.
Many of these security checks are based on recommendations from the WordPress codex: https://codex.wordpress.org/Hardening_WordPress.
<h4>Disclaimer</h4>
Some of the tips included in this plugin only require making small changes to configuration files (.htaccess, php.ini, wp-config.php, functions.php). Others require more in-depth changes to the filesystem or database. Before attempting any of these fixes, you should be comfortable experimenting and know how to undo any change you make. That includes making backups and knowing how restore your site from those backups. I can’t guarantee that the recommendations or sample code provided in this plugin will not break your site or that they will prevent it from being hacked.
<h4>Requirements</h4>
<ul>
<li>Apache web server</li>
<li>WordPress 3.4 minimum</li>
<li>PHP 5.2.7 minimum</li>
</ul>

Gauntlet Security

Performs a detailed security analysis of your WordPress installation. Provides specific instructions on how to make your site more secure.

NIS2 Compliance vs Gauntlet Security