harish282

<p>NiyiGuard hardens WordPress at the <strong>application layer</strong>: login abuse, accountability, file integrity, browser security headers, optional rate limits, and WooCommerce-specific threats. It <strong>complements</strong> your host firewall, CDN, or WAF — it does not replace them.</p>
<p>Source code and issue tracker: https://github.com/harish282/securepress</p>
<h4>Why install NiyiGuard?</h4>
<ul>
<li><strong>Self-hosted</strong> — security data stays on your server; no NiyiGuard account and no usage telemetry to the author.</li>
<li><strong>One dashboard</strong> — enable or disable modules (authentication, audit log, integrity, headers, rate limits, WooCommerce protection).</li>
<li><strong>For store owners</strong> — reduce fake checkouts, cart and coupon abuse, registration spam, and Store API abuse when WooCommerce is active.</li>
<li><strong>For developers</strong> — protect custom <code>admin-post</code> handlers, forms, and REST routes with the <strong>Security SDK</strong> (CSRF, rate limits, signed URLs, route guards).</li>
<li><strong>Fully free</strong> — no license key, beta trial, or paywalled module in 0.1.0.</li>
</ul>
<h4>What makes it different?</h4>
<p>Many security plugins offer two-factor auth, lockouts, headers, or malware scanning. NiyiGuard does not claim to be the only plugin with those features. It stands out in three ways:</p>
<ol>
<li><strong>Developer SDK</strong> — middleware-style helpers for <strong>your</strong> code paths, not only wp-admin toggles.</li>
<li><strong>WooCommerce abuse pipelines</strong> — checkout, cart, registration, and Store API protection in the same package as audit logging and login hardening.</li>
<li><strong>Privacy-first</strong> — no license server and no analytics to the author (see Privacy section below).</li>
</ol>
<p>Longer positioning notes and reusable marketing copy: <code>docs/WHY_NIYIGUARD.md</code>.</p>
<h4>Features included (0.1.0)</h4>
<ul>
<li><strong>Authentication hardening</strong> — login lockouts (IP and username), TOTP and email two-factor authentication, recovery codes, session tracking with remote revoke, and new-device suspicious-login email alerts.</li>
<li><strong>Security headers</strong> — HSTS, Content-Security-Policy, X-Frame-Options, Referrer-Policy, Permissions-Policy, and X-Content-Type-Options (each header can be toggled).</li>
<li><strong>Audit log</strong> — logins, plugin changes, role changes, selected option changes, file editor use, and WooCommerce-related actions. Admin list UI, detail view, retention, and scheduled pruning.</li>
<li><strong>File integrity monitoring</strong> — WordPress.org core checksum comparison, plugin manifest diff scans, suspicious PHP heuristics, and optional themes/uploads scopes (scheduled scans).</li>
<li><strong>Rate limiting</strong> — optional global throttling for front-end, AJAX, wp-login, and REST API traffic (wp-admin dashboard loads excluded by default).</li>
<li><strong>WooCommerce Protection</strong> — checkout, cart, registration, and Store API pipelines (velocity limits, honeypots, disposable-email checks, fraud scoring, coupon abuse). Requires WooCommerce.</li>
<li><strong>CSRF middleware and SDK</strong> — nonce verification for custom routes, forms, and REST handlers you register.</li>
<li><strong>Signed URLs</strong> — time-limited HMAC links for downloads, invites, and sensitive actions.</li>
<li><strong>Login URL disguise</strong> — optional custom login path instead of <code>wp-login.php</code> (off by default; test on staging first).</li>
<li><strong>Safe mode</strong> — emergency bypass via <code>NIYIGUARD_SAFE_MODE</code> in <code>wp-config.php</code> without changing saved settings.</li>
<li><strong>Health diagnostics</strong> — hooks, database tables, and module state on an admin screen.</li>
<li><strong>MU loader helper</strong> — optional must-use loader for earlier bootstrap in the request lifecycle.</li>
</ul>
<p>The <strong>NiyiGuard <span aria-hidden="true" class="wp-exclude-emoji">→</span> Dashboard</strong> includes optional links to leave a WordPress.org review or support development (Ko-fi). Neither is required.</p>
<h4>Developer APIs</h4>
<p>The <code>Security</code> facade provides route guards, CSRF fields, rate limiters, signed URLs, and related helpers. Documented in <code>docs/USAGE.md</code>. Middleware applies to <strong>routes you protect</strong> — it is not automatic site-wide protection for every WordPress hook. Before production, follow <code>docs/STAGING_TEST_PLAN.md</code>.</p>
<h4>Requirements</h4>
<ul>
<li>WordPress 6.4+</li>
<li>PHP 8.2+</li>
<li>MySQL 5.7+ or MariaDB 10.3+ (standard WordPress database)</li>
</ul>
<h3>Privacy</h3>
<p>NiyiGuard processes security-related data on your WordPress server (IP addresses, user agents, user IDs, audit events, session metadata, and similar fields when features are enabled). It does not sell personal data or include advertising trackers.</p>
<p><strong>Third-party service</strong></p>
<ul>
<li><strong>WordPress.org Core Checksums API</strong> (<code>https://api.wordpress.org/core/checksums/1.0/</code>) — used for core file integrity checks (WordPress version and locale only; responses may be cached about 12 hours).</li>
</ul>
<p><strong>Email</strong></p>
<p>Optional security emails (two-factor codes, suspicious-login alerts) use WordPress <code>wp_mail()</code> and your site’s mail configuration.</p>
<p><strong>Optional donations</strong></p>
<p>If you use the dashboard Ko-fi link, payment and any data you provide are handled by Ko-fi under their terms, not by NiyiGuard.</p>
<p>Full details: <code>docs/PRIVACY.md</code> in the plugin folder, and the Privacy section below.</p>


NiyiGuard

Self-hosted WordPress security: 2FA, lockouts, audit log, integrity, headers, rate limits, WooCommerce protection, and SDK. Free.

noplanman

<p>With WP-OTP you can easily set up 2 Factor Authentication with One Time Passwords for your WordPress login.<br />
This extra layer makes your WordPress site a lot more secure.</p>
<p>The new stealth mode allows for invisible OTP code entry, making your login screen look like any other, no extra OTP code input field.</p>
<h4>Getting started</h4>
<p>After installing and activating the plugin, every user can enable WP-OTP on their profile page.</p>
<p>It’s as easy as scanning the provided QR Code or entering the OTP secret to any OTP generator app.<br />
Then just activate it by entering the generated OTP and voilà, all set up.<br />
Now, the login requires an OTP code to succeed.</p>
<p>Each user gets their own secret key to authenticate with, giving them control over their login security.</p>
<h4>Development</h4>
<p>This plugin is completely open source and a work of passion.<br />
If you would like to be part of it and join in, make your way over to the <a href="https://git.feneas.org/noplanman/wp-otp" rel="nofollow ugc">project page</a> now.<br />
Also, if you have an idea you would like to see in this plugin or if you’ve found a bug, please <a href="https://git.feneas.org/noplanman/wp-otp/issues/new" rel="nofollow ugc">let me know</a>.</p>
<h4>Configuration</h4>
<ul>
<li><code>WP_OTP_STEALTH</code>: Set this to <code>true</code> to enable stealth OTP mode.</li>
</ul>
<h4>Filters</h4>
<p>There are a multitude of filters to be adjusted.</p>
<ul>
<li><code>wp_otp_qr_code_provisioning_uri</code>: URI for online QR Code rendering (must contain <code>{PROVISIONING_URI}</code> placeholder for QR Code data).</li>
<li><code>wp_otp_login_form_text</code>: Text for input field on the login screen.</li>
<li><code>wp_otp_login_form_text_sub</code>: Subtext for the input field on the login screen.</li>
<li><code>wp_otp_login_form_invalid_code_text</code>: Error text for an invalid code input on the login screen.</li>
<li><code>wp_otp_code_expiration_window</code>: Set the window of code verification expiration.</li>
<li><code>wp_otp_recovery_codes_count</code>: Number of recovery codes to generate.</li>
<li><code>wp_otp_recovery_codes_length</code>: Length of the recovery codes.</li>
<li><code>wp_otp_secret_length</code>: Length of the secret key.</li>
</ul>
<h4>Minimum requirements</h4>
<p>WordPress 4.6, PHP 7.4.</p>
<h4>Donate / Support</h4>
<p>All <a href="https://noplanman.ch/donate" rel="nofollow ugc">donations</a> are much appreciated, thank you 🙏</p>
<p><a href="https://tidelift.com/subscription/pkg/wordpress-wp-otp?utm_source=wordpress-wp-otp&utm_medium=referral&utm_campaign=readme" rel="nofollow ugc">Get professional support for this plugin with a Tidelift subscription</a><br />
<em>Tidelift helps make open source sustainable for maintainers while giving companies assurances about security, maintenance, and licensing for their dependencies.</em></p>
<h4>Security</h4>
<p>To report a security vulnerability, please use the <a href="https://tidelift.com/security" rel="nofollow ugc">Tidelift security contact</a>. Tidelift will coordinate the fix and disclosure.</p>


WP-OTP

Make your WordPress login extra secure with One Time Passwords.

NiyiGuard vs WP-OTP