Marc Armengou

PlugSeal gives administrators granular control over what each active plugin is allowed to do, inspired by Android app permissions and Flatseal for Flatpak. Each active plugin is listed in the settings page. For each plugin, administrators can allow or deny individual permissions with immediate effect. All permissions are allowed by default, so no existing functionality is broken until an administrator explicitly restricts it.
Permissions covered:
<ul>
<li><code>db:read</code> / <code>db:write</code> — database queries via $wpdb</li>
<li><code>db:read:users</code> / <code>db:write:users</code> — read and write access to user data (also covers wp_delete_user and wp_update_user)</li>
<li><code>http:outbound</code> — outbound HTTP requests via the WordPress HTTP API</li>
<li><code>options:read</code> / <code>options:write</code> — WordPress options via get_option / update_option (see limitations)</li>
<li><code>email:send</code> — sending email via wp_mail()</li>
<li><code>cron:write</code> — scheduling events via wp_schedule_event()</li>
<li><code>transients:write</code> — writing transients via set_transient()</li>
<li><code>users:create</code> — creating users via wp_create_user() (deletes are covered by db:write:users)</li>
<li><code>rest:register</code> — registering REST API endpoints via register_rest_route()</li>
<li><code>shortcode:register</code> — registering shortcodes via add_shortcode()</li>
<li><code>rewrite:register</code> — registering rewrite rules via add_rewrite_rule()</li>
<li><code>admin:menu</code> — adding entries to the admin menu and submenus</li>
<li><code>dashboard:widget</code> — adding dashboard widgets via wp_add_dashboard_widget()</li>
<li><code>hooks:frontend</code> — hooking into frontend hooks (wp_head, wp_footer, the_content, wp_enqueue_scripts…)</li>
<li><code>hooks:admin</code> — hooking into admin hooks (admin_head, admin_notices, admin_enqueue_scripts…)</li>
<li><code>hooks:auth</code> — hooking into authentication hooks (wp_login, wp_logout, user_register, authenticate…)</li>
<li><code>hooks:content</code> — hooking into content hooks (save_post, delete_post, pre_get_posts, wp_handle_upload…)</li>
<li><code>hooks:lifecycle</code> — hooking into plugin and theme lifecycle hooks (activated_plugin, deactivated_plugin, switch_theme…)</li>
</ul>
Honest limitations:
This plugin intercepts official WordPress APIs by identifying the calling plugin via the PHP call stack. It cannot intercept calls made by WordPress core on behalf of a plugin — for example, when WordPress processes a settings form via <code>options.php</code>, the call stack contains core files rather than the plugin files.
Specific limitations:
<ul>
<li><code>options:read</code> / <code>options:write</code> — work when a plugin calls these APIs directly from its own code (hooks, AJAX, cron). Do not block standard WordPress settings forms processed by <code>options.php</code>.</li>
<li>Filesystem access (<code>file_get_contents</code>, <code>fopen</code>, etc.) is not intercepted.</li>
<li>Direct <code>mysqli</code> connections, <code>eval()</code>, and raw PHP file functions bypass all interceptors.</li>
<li><code>wp_update_user()</code> and <code>wp_delete_user()</code> are covered by <code>db:write:users</code> since they write directly to the users table.</li>
<li><code>admin_init</code> is intentionally excluded from <code>hooks:admin</code> as it is too critical to block safely.</li>
</ul>

PlugSeal

Control what each active plugin is allowed to do. Allow or deny specific permissions per plugin, with immediate effect.

Ashar

SecurelyWP

SecurelyWP is a hassle-free security plugin that makes your WordPress site safer the moment you activate it. Most features work out of the box, with optional CAPTCHA and two-factor authentication (2FA) configuration for enhanced protection. It includes strong security features, system details, security headers, CAPTCHA integration, and 2FA to keep your site secure and healthy.
Why Choose SecurelyWP?
<ul>
<li>Works Out of the Box: Most security features activate automatically upon installation.</li>
<li>Comprehensive Protection: Guards against hacking, malicious files, form spam, and unauthorized access.</li>
<li>Lightweight: Designed to run smoothly without affecting your site’s speed or performance.</li>
<li>Free Features: Includes system details, security headers, CAPTCHA, and 2FA to monitor and protect your site.</li>
</ul>
<h3>Features</h3>
<ul>
<li>
Hide WordPress Version
<ul>
<li>Why: Stops hackers from targeting weaknesses in your WordPress version. </li>
<li>Impact: Good protection with no effect on your site’s appearance.</li>
</ul>
</li>
<li>
Disable PHP Execution in Uploads Folder
<ul>
<li>Why: Prevents harmful scripts from running if someone uploads a malicious file. </li>
<li>Impact: Strong defense against file-based attacks.</li>
</ul>
</li>
<li>
Prevent User Enumeration
<ul>
<li>Why: Blocks hackers from guessing usernames through sneaky methods. </li>
<li>Impact: Keeps your user list safe from prying eyes.</li>
</ul>
</li>
<li>
Detect & Warn About “admin” Username
<ul>
<li>Why: Alerts you if your site uses the risky “admin” username. </li>
<li>Impact: Big security boost if you change the username.</li>
</ul>
</li>
<li>
Disable File Editing in Dashboard
<ul>
<li>Why: Stops anyone from modifying your site’s code through the WordPress dashboard. </li>
<li>Impact: Major safeguard against unauthorized code changes.</li>
</ul>
</li>
<li>
Force HTTPS for Login & Admin
<ul>
<li>Why: Ensures your login and admin pages use a secure connection. </li>
<li>Impact: Critical for keeping your credentials safe.</li>
</ul>
</li>
<li>
Basic Brute Force Protection (Lite)
<ul>
<li>Why: Temporarily blocks repeated failed login attempts. </li>
<li>Impact: Strong protection against login attacks.</li>
</ul>
</li>
<li>
System Details
<ul>
<li>Why: Shows important info about your site to monitor its health. </li>
<li>Impact: Keeps you informed about your site’s status.</li>
</ul>
</li>
<li>
Security Headers
<ul>
<li>Why: Adds HTTP headers to improve your site’s security. </li>
<li>Impact: Strengthens your site’s defense with minimal setup.</li>
</ul>
</li>
<li>
CAPTCHA Protection (Cloudflare Turnstile)
<ul>
<li>Why: Adds CAPTCHA to prevent spam and bot submissions. </li>
<li>Impact: Enhances form security with user-friendly CAPTCHA.</li>
</ul>
</li>
<li>
Two-Factor Authentication (2FA)
<ul>
<li>Why: Adds an extra layer of security by requiring a second verification step during login. </li>
<li>Impact: Significantly reduces the risk of unauthorized access. </li>
</ul>
</li>
</ul>
2FA Features: 
– Authenticator App (TOTP): Use apps like Google Authenticator or Authy for time-based codes. 
– Email 2FA: Receive codes via email for verification. 
– Recovery Codes: Generate emergency codes for access if other methods are unavailable. 
– Per-User Settings: Each user can configure their own 2FA preferences. 
– Multisite Support: Super admins can enforce 2FA network-wide. 
– Flexible Options: Choose primary 2FA method from TOTP, Email 2FA, or Recovery Codes.
Supported Forms, Plugins & Multisite for CAPTCHA: 
– Core WordPress: Login, Registration, Lost Password, Comment 
– E-commerce & Membership: WooCommerce Checkout, MemberPress, Ultimate Member, WP-Members 
– Form Plugins: WPForms, Gravity Forms, Contact Form 7 (CF7), Formidable Forms, Forminator, Elementor Pro, Easy Digital Downloads (EDD), Mailchimp for WordPress 
– Community / Forums: BuddyPress, bbPress 
– Multisite: Multisite Signup Forms
<h3>How to Set Up CAPTCHA with Cloudflare Turnstile</h3>
<ol>
<li>Sign Up for Cloudflare: Go to https://www.cloudflare.com/ and create a free account or log in. </li>
<li>Add Your Site: Click “Add a Site” in the dashboard and enter your domain. </li>
<li>Access Turnstile: Navigate to the “Turnstile” section in the Cloudflare dashboard. </li>
<li>Create a Turnstile Widget:
<ul>
<li>Click “Add Widget” </li>
<li>Provide a name (e.g., “SecurelyWP CAPTCHA”) </li>
<li>Add Hostnames (your domain, e.g., example.com) → Click “Add” </li>
<li>Choose the widget type (“Managed”) </li>
</ul>
</li>
<li>Get Your Keys: Copy the Site Key and Secret Key. </li>
<li>Add Keys to SecurelyWP: Go to SecurelyWP > CAPTCHA Settings in WordPress → paste keys → enable CAPTCHA for desired forms. </li>
<li>Test Your CAPTCHA: Visit a form to ensure the CAPTCHA widget appears and works correctly.</li>
</ol>
<h3>How to Set Up Two-Factor Authentication</h3>
<ol>
<li>Access 2FA Settings: Go to “Profile” > “Two-Factor Authentication” in your WordPress dashboard. </li>
<li>Enable 2FA Methods:
<ul>
<li>Authenticator App: Scan the QR code or enter the secret into your app (Google Authenticator, Authy). Verify with a code. </li>
<li>Email 2FA: Enable to receive codes via email. </li>
<li>Recovery Codes: Generate emergency codes. Copy or download codes for safekeeping. </li>
</ul>
</li>
<li>Choose Primary Method: Select your preferred 2FA method (Authenticator App, Email, or Recovery Codes). </li>
<li>Test 2FA: Log out and log in to verify the 2FA prompt appears below the login form. </li>
<li>Multisite (Super Admins): Enable network-wide 2FA enforcement for all users.</li>
</ol>

SecurelyWP – all-in-one security

SecurelyWP is a simple security plugin that protects your WordPress site right after activation—no setup needed for most features.

PlugSeal vs SecurelyWP – all-in-one security