Uğur Biçer

fyndsoft

<p>Are you tired of bloated security plugins that slow down your website and clutter your database?</p>
<p>SecureFusion is designed for WordPress site administrators, developers, and agency owners who demand lightweight, robust, and performance-optimized protection. It acts as an active shield against brute-force attacks, remote XML-RPC exploits, and malicious injections, while keeping your loading speeds lightning fast.</p>
<p>SecureFusion helps you enforce strict Content Security Policies (CSP), hide standard administrative entry points, block automated traffic clusters, track successful/failed logins, block spam comment IPs directly, and monitor unauthorized access patterns via a clean, modern dashboard.</p>
<h3>Features</h3>
<h4>1. Login Protection & Interactive Monitoring</h4>
<ul>
<li><strong>Failed Login Attempts Log:</strong> Visually tracks unauthorized login attempts, displaying timestamps, IP addresses, and lockouts.</li>
<li><strong>IP Range Clustering (/24 Subnets):</strong> Groups attacking IPs into standard /24 subnets. Admins can view individual subnet IPs and copy the CIDR lists to a firewall or Cloudflare blacklist.</li>
<li><strong>Custom Login URL:</strong> Obfuscates <code>wp-login.php</code> and <code>wp-admin</code> access by changing it to a secret URL, stopping automated bots instantly.</li>
<li><strong>Brute-Force Lockout:</strong> Restricts login attempts and locks out offending IPs.</li>
<li><strong>Modify Login Errors:</strong> Alters generic authentication errors so hackers cannot verify whether they got the username or password correct.</li>
</ul>
<h4>2. Firewall & Active Guard</h4>
<ul>
<li><strong>Filter Bad Requests:</strong> Screens URL requests to block XSS, CSRF, and code injection attempts before they reach your theme or database.</li>
<li><strong>REST API Control:</strong> Restricts public endpoint scraping, preventing attackers from harvesting user lists or plugin info.</li>
<li><strong>Content Security Policy (CSP):</strong> Easily configure and inject headers to control script, style, and media execution sources in the client browser.</li>
</ul>
<h4>3. XML-RPC Shield</h4>
<ul>
<li><strong>DDoS Amplification Defense:</strong> Fully disable XML-RPC, or selectively disable pingbacks, preventing your server from participating in DDoS botnets.</li>
<li><strong>XML-RPC Login Protection:</strong> Specifically blocks remote credentials verification through XML-RPC.</li>
</ul>
<h4>4. Enforced SSL / HTTPS</h4>
<ul>
<li><strong>Secure Protocol Redirection:</strong> Forces HTTP to HTTPS redirection across admin screens, login pages, or the entire site to guarantee secure data transmission.</li>
</ul>
<h4>5. Comments IP Blocking & Bulk Shield</h4>
<ul>
<li><strong>Individual Commenter IP Blocking:</strong> Block or unblock comment author IP addresses directly from the WordPress Comments list page.</li>
<li><strong>Bulk Spam IP Blocking:</strong> Instantly block all IP addresses associated with spam comments currently in the Spam directory.</li>
<li><strong>Smart CIDR Range Calculation:</strong> Option to block entire /24 IPv4 subnets or /64 IPv6 ranges of spam comments automatically based on IP distribution to stop persistent spam networks.</li>
</ul>
<h4>6. IP Spoofing Prevention & Successful Login Tracking</h4>
<ul>
<li><strong>Successful Login Logging:</strong> Tracks successful logins to audit administrator and user access alongside failed login attempts.</li>
<li><strong>IP Spoofing Prevention:</strong> Performs strict public vs. private IP checks on client headers (like HTTP_X_FORWARDED_FOR) to prevent attackers from spoofing their IP addresses when behind load balancers or proxies.</li>
</ul>
<p>For complete information, please visit our website <a href="https://fyndsoft.com/securefusion" rel="nofollow ugc">the SecureFusion website</a>.</p>
<h3>Credits</h3>
<p>This plugin bundles and/or utilizes the following third-party libraries:</p>
<ul>
<li>
<p><strong>Chart.js</strong> (v4.5.1)</p>
<ul>
<li>License: MIT</li>
<li>License URI: https://github.com/chartjs/Chart.js/blob/master/LICENSE.md</li>
<li>Source: https://www.chartjs.org</li>
</ul>
</li>
<li>
<p><strong>persist-admin-notices-dismissal</strong></p>
<ul>
<li>License: GPLv3</li>
<li>Source: https://github.com/collizo4sky/persist-admin-notices-dismissal</li>
</ul>
</li>
<li>
<p><strong>wasp</strong></p>
<ul>
<li>License: GPLv3</li>
<li>Source: https://github.com/uuur86/wasp</li>
</ul>
</li>
</ul>


SecureFusion – Security and Firewall by Fyndsoft

Lightweight, high-performance security suite. Protects from brute-force logins, DDoS pingbacks, bad request injections, and manages CSP headers.

Walter Ebert

<p>Removes all WordPress methods from the XML-RPC API to increase security. It does more than just using the <code>xmlrpc_enabled</code> hook, because that is only used “To disable XML-RPC methods that require authentication”.</p>
<p>Activating this plugin will also disable pingbacks, trackbacks, and Really Simple Discovery (RSD), because these rely on XML-RPC.</p>
<p>It works with any webserver, because it does not use the .htaccess file.</p>
<h4>Testing the plugin</h4>
<p>From the command line you can test if the plugin is working correctly using <a href="https://curl.haxx.se/" rel="nofollow ugc">curl</a>. Replace the <code>example.com</code> link to match your website:</p>
<pre><code>curl -d '<?xml version="1.0"?><methodCall><methodName>system.listMethods</methodName><params><param><value><string/></value></param></params></methodCall>' https://example.com/xmlrpc.php
</code></pre>
<p>This should only return the following methods:<br />
– <code>system.multicall</code><br />
– <code>system.listMethods</code><br />
– <code>system.getCapabilities</code></p>


Remove XML-RPC Methods

Remove all WordPress methods from the XML-RPC API to increase security.

SecureFusion – Security and Firewall by Fyndsoft vs Remove XML-RPC Methods