Marc Armengou

<p><strong>Security Hardener</strong> is inspired by the official WordPress hardening guide (Advanced Administration / Security / Hardening). It uses the platform’s standard functions and does not override core. Applies a prudent set of defenses:</p>
<ul>
<li><strong>Security headers</strong>: <code>X-Frame-Options</code>, <code>X-Content-Type-Options</code>, <code>Referrer-Policy</code>, <code>Permissions-Policy</code>, <code>COOP/CORP</code>.  </li>
<li><strong>HSTS</strong> (optional; HTTPS only).  </li>
<li><strong>Basic nonce-based CSP</strong> (optional; requires testing).  </li>
<li><strong>Disable XML-RPC and pingbacks</strong> (optional; enabled by default).  </li>
<li><strong>Hide the WordPress version</strong> in the <code><head></code>.  </li>
<li><strong>Block user enumeration</strong> via <code>/?author=</code> by returning 404.  </li>
<li><strong>Generic login errors</strong> (prevents information leakage).  </li>
<li><strong>IP-based login rate limiting</strong> with transients (configurable threshold and window).  </li>
<li><strong>Restrict the REST API</strong> to authenticated users, with a <strong>minimal allowlist</strong> for oEmbed/index.</li>
</ul>
<blockquote>
<p>⚠️ <strong>Important:</strong> The <strong>restrict REST API</strong> option and <strong>CSP</strong> can affect integrations and plugins. Test it in <em>staging</em> first.</p>
</blockquote>
<p><strong>Privacy</strong>: the plugin does not send data to external services or create new tables. It only uses transients to count failed login attempts.</p>


Security Hardener

Basic hardening: secure headers, enumeration blocking, generic login errors, IP-based rate limiting, and optional restriction of the REST API.

Lenon Leite

<p>Reduce risk for you site, running the easy hardening protection of mainly attacks.<br />
With hardening you can control bad request, blocking ips with malicious action like comments spam, brute force login and others.</p>
<h4>Hardening:</h4>
<ul>
<li>Disable Plugin Theme Editor</li>
<li>Hidden WordPress version</li>
<li>Deny WP Debug mode</li>
<li>Disable directory browsing</li>
<li>Disable author page</li>
<li>Fix corrects permissions</li>
<li>Change the prefix tables</li>
<li>Change the login url</li>
<li>2 Factor authentication</li>
<li>Google reCaptcha Option</li>
</ul>
<h4>Ip block Activity Options</h4>
<ul>
<li>Blocks comments with spam</li>
<li>Access malicious url</li>
<li>Blocks brute force</li>
</ul>
<h4>Mail notifications</h4>
<h4>Verifications:</h4>
<ul>
<li>Prefix tables</li>
<li>Easy usernames</li>
<li>Easy passwords</li>
<li>Check PHP Version</li>
<li>Check wrong permissions</li>
</ul>
<h4>Logs:</h4>
<ul>
<li>Save errors</li>
<li>User managers</li>
<li>Plugin managers</li>
</ul>


Integer Wp Security

WP security is a plugin responsible by security with short steps and fix the mainly security problems.

Security Hardener vs Integer Wp Security