pieceagency

Sovaryx Login Security strengthens your WordPress site’s login security while staying lightweight and easy to operate.
<h4>Key Features</h4>
<ul>
<li>Dashboard – Security score display with quick overview of your site’s security status</li>
<li>Security Headers Scan – HTTP header validation and security recommendations</li>
<li>REST API Scan – Comprehensive API endpoint security verification (18 checks)</li>
<li>Login Security – Multi-layer login protection including brute force protection (enabled by default), IP restrictions with trusted proxy support, XML-RPC disable option, reCAPTCHA, Email OTP authentication with IP-based rate limiting, and threat intelligence integration</li>
<li>API Protection – REST API rate limiting and user enumeration prevention</li>
</ul>
<h4>Highlights</h4>
<ul>
<li>Lightweight design – Minimal impact on site performance</li>
<li>Multi-language support – English and Japanese</li>
<li>Plugin conflict detection – Automatic detection and warnings</li>
</ul>
<h4>System Requirements</h4>
<ul>
<li>WordPress 6.0 or higher</li>
<li>PHP 7.4 or higher</li>
<li>MySQL 5.7+ / MariaDB 10.2+</li>
</ul>
<h3>External Services</h3>
This plugin connects to external services for certain features. Below is a description of each service, what data is sent, and when.
<h4>Google reCAPTCHA (Optional)</h4>
When you enable reCAPTCHA protection for the login page, this plugin loads Google reCAPTCHA scripts and sends verification requests.
<ul>
<li>Service Provider: Google LLC</li>
<li>What it is used for: Protecting the login page from automated bots and brute force attacks</li>
<li>Data sent: User IP address, browser information, and interaction data for bot detection</li>
<li>When data is sent: When the login page is loaded and when a login form is submitted</li>
<li>Terms of Service: https://policies.google.com/terms</li>
<li>Privacy Policy: https://policies.google.com/privacy</li>
</ul>
<h4>Threat Intelligence Services (Optional)</h4>
When threat intelligence features are enabled in Login Security settings, the plugin queries external threat databases to check visitor IP addresses for malicious activity. This helps protect your login page from known attackers.
Spamhaus 
* What it is used for: Checking if an IP is listed in spam/threat databases 
* Data sent: Visitor IP address 
* When data is sent: When a visitor accesses the site and threat intelligence is enabled 
* Website: https://www.spamhaus.org 
* Terms: https://www.spamhaus.org/legal/
AbuseIPDB 
* What it is used for: Checking IP abuse reports 
* Data sent: Visitor IP address 
* When data is sent: When a visitor accesses the site and threat intelligence is enabled 
* Terms of Service: https://www.abuseipdb.com/legal 
* Privacy Policy: https://www.abuseipdb.com/privacy
Project Honey Pot 
* What it is used for: Identifying harvesters, spammers, and malicious bots 
* Data sent: Visitor IP address 
* When data is sent: When a visitor accesses the site and threat intelligence is enabled 
* Website: https://www.projecthoneypot.org 
* Terms: https://www.projecthoneypot.org/terms_of_service_use.php
Cloudflare Radar 
* What it is used for: Checking if an IP address is associated with malware, botnets, phishing, or spam 
* Data sent: Visitor IP address 
* When data is sent: When a visitor accesses the site and threat intelligence is enabled 
* Terms of Service: https://www.cloudflare.com/terms/ 
* Privacy Policy: https://www.cloudflare.com/privacypolicy/
IP2Location / IP2Proxy 
* What it is used for: Detecting proxy, VPN, and Tor connections from visitor IP addresses 
* Data sent: Visitor IP address 
* When data is sent: When a visitor accesses the site and threat intelligence is enabled 
* Terms of Service: https://www.ip2location.com/terms 
* Privacy Policy: https://www.ip2location.com/privacy-policy

Sovaryx Login Security

A free WordPress security plugin focused on login protection, security diagnostics, and API protection.

Jeff Starr

👉 Enables custom headers for WP email notifications
👉 Also provides a “set it and forget it” security fix for WP < 5.5
👉 Uses only 50KB of code, so super lightweight, fast, and effective
Important
As of WordPress 5.5, this plugin no longer is necessary to fix the <a href="https://exploitbox.io/vuln/WordPress-Exploit-4-7-Unauth-Password-Reset-0day-CVE-2017-8295.html" rel="nofollow ugc">host-header security issue</a> reported in <a href="https://core.trac.wordpress.org/ticket/25239" rel="nofollow ugc">Ticket #25239</a> finally is fixed, and mentioned in this post <a href="https://wordpress.org/news/2020/07/wordpress-5-5-beta-4/" rel="ugc">WordPress 5.5 Beta 4</a>. Thank You WordPress devs!
Is this plugin still useful?
Yes, it enables you to choose the “From”, “Name”, and “Return-Path” headers for all WP notification emails. And for versions of WordPress less than 5.5, this plugin continues to fix the host-header injection security issue.
Features
This simple plugin does three things:
<ol>
<li>Sets custom From, Name, and Return-Path for WP notifications</li>
<li>Fixes a security vulnerability in WordPress versions < 5.5</li>
<li>Fixes a bug where invalid email addresses may be generated (in WordPress versions < 5.5)</li>
</ol>
Choose from the following options:
<ul>
<li>Use WordPress defaults (insecure for WP < 5.5)</li>
<li>Use “Email Address” from WP General Settings</li>
<li>Use a custom name and address</li>
</ul>
Plus there is an option to use the specified From address as the Return-Path header.
Why?
The security issue fixed by this plugin has been known about since way back in WordPress version 2.3. There has been some talk about fixing, but nothing has been implemented. While the issue does not affect all sites, it does affect a good percentage of them, including some of my own projects. So, not wanting to get hacked, I decided to write my own solution. Hopefully this issue gets fixed in a future version of WordPress, and this plugin will become unnecessary.
As a bonus, setting an explicit From address resolves a long-standing bug whereby an invalid email address is generated under the following conditions:
<ul>
<li>A “From” address is not set, </li>
<li>And the <code>$_SERVER['SERVER_NAME']</code> is empty</li>
</ul>
So by explicitly setting a “From” address, we prevent this bug from happening.
Security Issue
What is the security issue addressed by this plugin? Follows is a quick summary. To learn more in-depth, check out the resources linked in the next section.
<ul>
<li>WP uses <code>$_SERVER['SERVER_NAME']</code> to set the “From” header in email notifications</li>
<li>This includes sensitive email notifications like password resets and user registration</li>
<li>In some cases, an attacker could modify the “From” header and intercept the email</li>
<li>Using the intercepted email, an attacker could gain access to your site and wreak havoc</li>
</ul>
More Infos
This security vulnerability is well-known and has been around for a looong time. To learn more, check out these articles:
<ul>
<li><a href="https://core.trac.wordpress.org/ticket/25239" rel="nofollow ugc">WP Core Trac Ticket</a></li>
<li><a href="https://exploitbox.io/vuln/WordPress-Exploit-4-7-Unauth-Password-Reset-0day-CVE-2017-8295.html" rel="nofollow ugc">Exploit Box Info</a></li>
<li><a href="https://www.exploit-db.com/exploits/41963" rel="nofollow ugc">Exploit Database</a></li>
</ul>
Privacy
This plugin does not collect or store any user data. It does not set any cookies, and it does not connect to any third-party locations. Thus, this plugin does not affect user privacy in any way.
Host Header Injection Fix is developed and maintained by <a href="https://x.com/perishable" rel="nofollow ugc">Jeff Starr</a>, 15-year <a href="https://plugin-planet.com/" rel="nofollow ugc">WordPress developer</a> and <a href="https://books.perishablepress.com/" rel="nofollow ugc">book author</a>.
Support development
I develop and maintain this free plugin with love for the WordPress community. To show support, you can <a href="https://monzillamedia.com/donate.html" rel="nofollow ugc">make a donation</a> or purchase one of my books:
<ul>
<li><a href="https://wp-tao.com/" rel="nofollow ugc">The Tao of WordPress</a></li>
<li><a href="https://digwp.com/" rel="nofollow ugc">Digging into WordPress</a></li>
<li><a href="https://htaccessbook.com/" rel="nofollow ugc">.htaccess made easy</a></li>
<li><a href="https://wp-tao.com/wordpress-themes-book/" rel="nofollow ugc">WordPress Themes In Depth</a></li>
<li><a href="https://books.perishablepress.com/downloads/wizards-collection-sql-recipes-wordpress/" rel="nofollow ugc">Wizard’s SQL Recipes for WordPress</a></li>
</ul>
And/or purchase one of my premium WordPress plugins:
<ul>
<li><a href="https://plugin-planet.com/bbq-pro/" rel="nofollow ugc">BBQ Pro</a> – Blazing fast WordPress firewall</li>
<li><a href="https://plugin-planet.com/blackhole-pro/" rel="nofollow ugc">Blackhole Pro</a> – Automatically block bad bots</li>
<li><a href="https://plugin-planet.com/banhammer-pro/" rel="nofollow ugc">Banhammer Pro</a> – Monitor traffic and ban the bad guys</li>
<li><a href="https://plugin-planet.com/ga-google-analytics-pro/" rel="nofollow ugc">GA Google Analytics Pro</a> – Connect WordPress to Google Analytics</li>
<li><a href="https://plugin-planet.com/head-meta-pro/" rel="nofollow ugc">Head Meta Pro</a> – Ultimate Meta Tags for WordPress</li>
<li><a href="https://plugin-planet.com/rest-pro-tools/" rel="nofollow ugc">REST Pro Tools</a> – Awesome tools for managing the WP REST API</li>
<li><a href="https://plugin-planet.com/simple-ajax-chat-pro/" rel="nofollow ugc">Simple Ajax Chat Pro</a> – Unlimited chat rooms</li>
<li><a href="https://plugin-planet.com/usp-pro/" rel="nofollow ugc">USP Pro</a> – Unlimited front-end forms</li>
</ul>
Links, tweets and likes also appreciated. Thank you! 🙂

Host Header Injection Fix

Sets custom headers for WP notification emails. Also fixes a security issue with WP versions < 5.5.

Sovaryx Login Security vs Host Header Injection Fix