Uğur Biçer

fyndsoft

<p>Are you tired of bloated security plugins that slow down your website and clutter your database?</p>
<p>SecureFusion is designed for WordPress site administrators, developers, and agency owners who demand lightweight, robust, and performance-optimized protection. It acts as an active shield against brute-force attacks, remote XML-RPC exploits, and malicious injections, while keeping your loading speeds lightning fast.</p>
<p>SecureFusion helps you enforce strict Content Security Policies (CSP), hide standard administrative entry points, block automated traffic clusters, track successful/failed logins, block spam comment IPs directly, and monitor unauthorized access patterns via a clean, modern dashboard.</p>
<h3>Features</h3>
<h4>1. Login Protection & Interactive Monitoring</h4>
<ul>
<li><strong>Failed Login Attempts Log:</strong> Visually tracks unauthorized login attempts, displaying timestamps, IP addresses, and lockouts.</li>
<li><strong>IP Range Clustering (/24 Subnets):</strong> Groups attacking IPs into standard /24 subnets. Admins can view individual subnet IPs and copy the CIDR lists to a firewall or Cloudflare blacklist.</li>
<li><strong>Custom Login URL:</strong> Obfuscates <code>wp-login.php</code> and <code>wp-admin</code> access by changing it to a secret URL, stopping automated bots instantly.</li>
<li><strong>Brute-Force Lockout:</strong> Restricts login attempts and locks out offending IPs.</li>
<li><strong>Modify Login Errors:</strong> Alters generic authentication errors so hackers cannot verify whether they got the username or password correct.</li>
</ul>
<h4>2. Firewall & Active Guard</h4>
<ul>
<li><strong>Filter Bad Requests:</strong> Screens URL requests to block XSS, CSRF, and code injection attempts before they reach your theme or database.</li>
<li><strong>REST API Control:</strong> Restricts public endpoint scraping, preventing attackers from harvesting user lists or plugin info.</li>
<li><strong>Content Security Policy (CSP):</strong> Easily configure and inject headers to control script, style, and media execution sources in the client browser.</li>
</ul>
<h4>3. XML-RPC Shield</h4>
<ul>
<li><strong>DDoS Amplification Defense:</strong> Fully disable XML-RPC, or selectively disable pingbacks, preventing your server from participating in DDoS botnets.</li>
<li><strong>XML-RPC Login Protection:</strong> Specifically blocks remote credentials verification through XML-RPC.</li>
</ul>
<h4>4. Enforced SSL / HTTPS</h4>
<ul>
<li><strong>Secure Protocol Redirection:</strong> Forces HTTP to HTTPS redirection across admin screens, login pages, or the entire site to guarantee secure data transmission.</li>
</ul>
<h4>5. Comments IP Blocking & Bulk Shield</h4>
<ul>
<li><strong>Individual Commenter IP Blocking:</strong> Block or unblock comment author IP addresses directly from the WordPress Comments list page.</li>
<li><strong>Bulk Spam IP Blocking:</strong> Instantly block all IP addresses associated with spam comments currently in the Spam directory.</li>
<li><strong>Smart CIDR Range Calculation:</strong> Option to block entire /24 IPv4 subnets or /64 IPv6 ranges of spam comments automatically based on IP distribution to stop persistent spam networks.</li>
</ul>
<h4>6. IP Spoofing Prevention & Successful Login Tracking</h4>
<ul>
<li><strong>Successful Login Logging:</strong> Tracks successful logins to audit administrator and user access alongside failed login attempts.</li>
<li><strong>IP Spoofing Prevention:</strong> Performs strict public vs. private IP checks on client headers (like HTTP_X_FORWARDED_FOR) to prevent attackers from spoofing their IP addresses when behind load balancers or proxies.</li>
</ul>
<p>For complete information, please visit our website <a href="https://fyndsoft.com/securefusion" rel="nofollow ugc">the SecureFusion website</a>.</p>
<h3>Credits</h3>
<p>This plugin bundles and/or utilizes the following third-party libraries:</p>
<ul>
<li>
<p><strong>Chart.js</strong> (v4.5.1)</p>
<ul>
<li>License: MIT</li>
<li>License URI: https://github.com/chartjs/Chart.js/blob/master/LICENSE.md</li>
<li>Source: https://www.chartjs.org</li>
</ul>
</li>
<li>
<p><strong>persist-admin-notices-dismissal</strong></p>
<ul>
<li>License: GPLv3</li>
<li>Source: https://github.com/collizo4sky/persist-admin-notices-dismissal</li>
</ul>
</li>
<li>
<p><strong>wasp</strong></p>
<ul>
<li>License: GPLv3</li>
<li>Source: https://github.com/uuur86/wasp</li>
</ul>
</li>
</ul>


SecureFusion – Security and Firewall by Fyndsoft

Lightweight, high-performance security suite. Protects from brute-force logins, DDoS pingbacks, bad request injections, and manages CSP headers.

Lars Koudal

cleverplugins

<p>Prevent your WordPress site from participating and being a victim of pingback denial of service attacks. <strong>After activation the plugin automatically disables XML-RPC. There’s no need to configure anything.</strong></p>
<p>By disabling the XML-RPC pingback you’ll:<br />
* lower your server CPU usage<br />
* prevent malicious scripts from using your site to run pingback denial of service attacks<br />
* prevent malicious scripts to run denial of service attacks on your site via pingback</p>
<p>From sucuri.net:</p>
<blockquote>
<p>Any WordPress site with Pingback enabled (which is on by default) can be used in DDOS attacks against other sites.</p>
</blockquote>
<h4>Learn More</h4>
<ul>
<li><a href="http://wptavern.com/how-to-prevent-wordpress-from-participating-in-pingback-denial-of-service-attacks" rel="nofollow ugc">How To Prevent WordPress From Participating In Pingback Denial of Service Attacks</a> – wptavern.com</li>
<li><a href="http://blog.sucuri.net/2014/03/more-than-162000-wordpress-sites-used-for-distributed-denial-of-service-attack.html" rel="nofollow ugc">More Than 162,000 WordPress Sites Used for Distributed Denial of Service Attack</a> – sucuri.net</li>
<li><a href="http://hackguard.com/xmlrpc-php-ping-backs-hackers-denial-service-attacks" rel="nofollow ugc">xmlrpc.php and Pingbacks and Denial of Service Attacks, Oh My!</a> – hackguard.com</li>
</ul>
<h4>Is Your Site Attacking Others?</h4>
<p>Use <a href="http://labs.sucuri.net/?is-my-wordpress-ddosing" rel="nofollow ugc">Sucuri’s WordPress DDOS Scanner</a> to check if your site is DDOS’ing other websites</p>
<h4>Why Not Just Disable XMLRPC Altogether?</h4>
<p>Yes, you can choose to do that, but if you use popular plugins like JetPack (that use XMLRPC) then those plugins will stop working. That is why this small plugin exists.</p>


Remove & Disable XML-RPC Pingback

Great plugin, super easy to install and just sits there doing it's job. Very light as well, so has no effects that I could see, on site speed or memory usage. Can't think of a reason why you wouldn't be using this to be honest. Thanks for developing it!

Just what I needed

Prevent pingback, XML-RPC and denial of service DDOS attacks by disabling the XML-RPC pingback functionality.

SecureFusion – Security and Firewall by Fyndsoft vs Remove & Disable XML-RPC Pingback