harish282

NiyiGuard hardens WordPress at the application layer: login abuse, accountability, file integrity, browser security headers, optional rate limits, and WooCommerce-specific threats. It complements your host firewall, CDN, or WAF — it does not replace them.
Source code and issue tracker: https://github.com/harish282/securepress
<h4>Why install NiyiGuard?</h4>
<ul>
<li>Self-hosted — security data stays on your server; no NiyiGuard account and no usage telemetry to the author.</li>
<li>One dashboard — enable or disable modules (authentication, audit log, integrity, headers, rate limits, WooCommerce protection).</li>
<li>For store owners — reduce fake checkouts, cart and coupon abuse, registration spam, and Store API abuse when WooCommerce is active.</li>
<li>For developers — protect custom <code>admin-post</code> handlers, forms, and REST routes with the Security SDK (CSRF, rate limits, signed URLs, route guards).</li>
<li>Fully free — no license key, beta trial, or paywalled module in 0.1.0.</li>
</ul>
<h4>What makes it different?</h4>
Many security plugins offer two-factor auth, lockouts, headers, or malware scanning. NiyiGuard does not claim to be the only plugin with those features. It stands out in three ways:
<ol>
<li>Developer SDK — middleware-style helpers for your code paths, not only wp-admin toggles.</li>
<li>WooCommerce abuse pipelines — checkout, cart, registration, and Store API protection in the same package as audit logging and login hardening.</li>
<li>Privacy-first — no license server and no analytics to the author (see Privacy section below).</li>
</ol>
Longer positioning notes and reusable marketing copy: <code>docs/WHY_NIYIGUARD.md</code>.
<h4>Features included (0.1.0)</h4>
<ul>
<li>Authentication hardening — login lockouts (IP and username), TOTP and email two-factor authentication, recovery codes, session tracking with remote revoke, and new-device suspicious-login email alerts.</li>
<li>Security headers — HSTS, Content-Security-Policy, X-Frame-Options, Referrer-Policy, Permissions-Policy, and X-Content-Type-Options (each header can be toggled).</li>
<li>Audit log — logins, plugin changes, role changes, selected option changes, file editor use, and WooCommerce-related actions. Admin list UI, detail view, retention, and scheduled pruning.</li>
<li>File integrity monitoring — WordPress.org core checksum comparison, plugin manifest diff scans, suspicious PHP heuristics, and optional themes/uploads scopes (scheduled scans).</li>
<li>Rate limiting — optional global throttling for front-end, AJAX, wp-login, and REST API traffic (wp-admin dashboard loads excluded by default).</li>
<li>WooCommerce Protection — checkout, cart, registration, and Store API pipelines (velocity limits, honeypots, disposable-email checks, fraud scoring, coupon abuse). Requires WooCommerce.</li>
<li>CSRF middleware and SDK — nonce verification for custom routes, forms, and REST handlers you register.</li>
<li>Signed URLs — time-limited HMAC links for downloads, invites, and sensitive actions.</li>
<li>Login URL disguise — optional custom login path instead of <code>wp-login.php</code> (off by default; test on staging first).</li>
<li>Safe mode — emergency bypass via <code>NIYIGUARD_SAFE_MODE</code> in <code>wp-config.php</code> without changing saved settings.</li>
<li>Health diagnostics — hooks, database tables, and module state on an admin screen.</li>
<li>MU loader helper — optional must-use loader for earlier bootstrap in the request lifecycle.</li>
</ul>
The NiyiGuard → Dashboard includes optional links to leave a WordPress.org review or support development (Ko-fi). Neither is required.
<h4>Developer APIs</h4>
The <code>Security</code> facade provides route guards, CSRF fields, rate limiters, signed URLs, and related helpers. Documented in <code>docs/USAGE.md</code>. Middleware applies to routes you protect — it is not automatic site-wide protection for every WordPress hook. Before production, follow <code>docs/STAGING_TEST_PLAN.md</code>.
<h4>Requirements</h4>
<ul>
<li>WordPress 6.4+</li>
<li>PHP 8.2+</li>
<li>MySQL 5.7+ or MariaDB 10.3+ (standard WordPress database)</li>
</ul>
<h3>Privacy</h3>
NiyiGuard processes security-related data on your WordPress server (IP addresses, user agents, user IDs, audit events, session metadata, and similar fields when features are enabled). It does not sell personal data or include advertising trackers.
Third-party service
<ul>
<li>WordPress.org Core Checksums API (<code>https://api.wordpress.org/core/checksums/1.0/</code>) — used for core file integrity checks (WordPress version and locale only; responses may be cached about 12 hours).</li>
</ul>
Email
Optional security emails (two-factor codes, suspicious-login alerts) use WordPress <code>wp_mail()</code> and your site’s mail configuration.
Optional donations
If you use the dashboard Ko-fi link, payment and any data you provide are handled by Ko-fi under their terms, not by NiyiGuard.
Full details: <code>docs/PRIVACY.md</code> in the plugin folder, and the Privacy section below.

NiyiGuard

Self-hosted WordPress security: 2FA, lockouts, audit log, integrity, headers, rate limits, WooCommerce protection, and SDK. Free.

Volodymyr Kolesnykov

This plugin adds WebAuthn and passkey support to the <a href="https://wordpress.org/plugins/two-factor/" rel="ugc">Two Factor</a> plugin, providing a modern, secure authentication method.
Features:
<ul>
<li>Support for WebAuthn and passkeys (Windows Hello, Touch ID, YubiKeys, etc.)</li>
<li>Backward compatibility with previously registered U2F security keys</li>
<li>User-friendly settings and seamless authentication experience</li>
<li>Customizable error logging and behavior via action hooks</li>
<li>Works with the Two Factor plugin for flexible 2FA authentication</li>
</ul>
The plugin enables users to register and use hardware security keys and platform authenticators for stronger protection against password-based attacks and phishing.
Notes:
<ul>
<li>please use <a href="https://github.com/sjinks/wp-two-factor-provider-webauthn/issues" rel="nofollow ugc">GitHub issues</a> to report bugs;</li>
<li>the full source code with all development files is available on <a href="https://github.com/sjinks/wp-two-factor-provider-webauthn" rel="nofollow ugc">GitHub</a>.</li>
</ul>

WebAuthn Provider for Two Factor

Thank you so much for this plugin!!  

In February 2022 Chrome changed things so hardware security keys would no longer work with the "Two Factor" plugin. Installing this add-on gets it working again. 

I had to change the "User Verification Requirement" to "Discouraged" in order to use my existing Yubikey (without re-adding it). Otherwise, it asked for a PIN but then wouldn't recognize my key.

Hopefully it can get merged directly into the Two Factor plugin soon? 😁🙏

Two Factor works with hardware keys again!

Thank you for bridging the gap while we wait for the PR. 
This is what Open Source is all about. 

FIDO U2F WebAuthn for Two Factor


This is helpful for evaluating purposes of the code. As this plugin is part of a security level all the code should be readable easily for auditors.



Besides that, well done.Thank you.


Works well for my use case but please provide unminified JS files.


This is great. You can literally log into WordPress with 2FA using one touch (password manager with auto-login combined with this for 2FA). Beats using an authenticator app any day.


One touch 2FA is a dream

WebAuthn authentication provider for Two Factor plugin.

NiyiGuard vs WebAuthn Provider for Two Factor