sweetwatermedia

Steel Security & Hardening – Site Audit Tools focuses on practical security hygiene for WordPress administrators.
The free plugin provides:
<ul>
<li>on-demand security scans</li>
<li>risk summaries grouped by severity and category</li>
<li>checks for common WordPress hardening gaps</li>
<li>checks for exposed root-level artifacts such as <code>.env</code>, SQL dumps, <code>phpinfo</code> files, and backup archives</li>
<li>a quarantine vault for operator-reviewed file isolation</li>
<li>uploads PHP execution blocking on supported server environments</li>
<li>manual guidance when automatic server hardening is not safely supported</li>
</ul>
This plugin is positioned as an auditing and hardening tool. It helps surface risk and apply selected preventive controls, but it does not promise malware removal, incident response, or complete server protection.
<h4>Included checks</h4>
The scan currently looks for items such as:
<ul>
<li>PHP error display exposure</li>
<li><code>WP_DEBUG</code> and <code>debug.log</code> exposure</li>
<li>XML-RPC availability</li>
<li>author and REST user enumeration exposure</li>
<li>theme/plugin file editor availability</li>
<li>WordPress generator meta output</li>
<li>comments enabled by default</li>
<li>uploads PHP execution hardening status</li>
<li>root-level sensitive files and archives</li>
</ul>
<h4>Server-aware behavior</h4>
This plugin only auto-applies server config changes where it can do so in a scoped and reversible way.
<ul>
<li>Apache and LiteSpeed: uploads PHP blocking is managed through a Steel Security-marked <code>.htaccess</code> block</li>
<li>IIS: uploads PHP blocking is managed through a Steel Security-marked <code>web.config</code> section</li>
<li>Nginx and unsupported environments: Steel Security provides manual guidance instead of claiming automatic protection</li>
</ul>
<h4>Pro companion</h4>
This plugin can work with a separate Pro companion plugin that adds features such as scheduled scans, scan history, reports, and managed server-level controls such as directory listing protection and baseline security headers. The free plugin remains usable on its own.

Steel Security & Hardening – Site Audit Tools

High-signal WordPress security auditing and hardening with practical site audit tools for administrators.

Ashar

SecurelyWP

SecurelyWP is a hassle-free security plugin that makes your WordPress site safer the moment you activate it. Most features work out of the box, with optional CAPTCHA and two-factor authentication (2FA) configuration for enhanced protection. It includes strong security features, system details, security headers, CAPTCHA integration, and 2FA to keep your site secure and healthy.
Why Choose SecurelyWP?
<ul>
<li>Works Out of the Box: Most security features activate automatically upon installation.</li>
<li>Comprehensive Protection: Guards against hacking, malicious files, form spam, and unauthorized access.</li>
<li>Lightweight: Designed to run smoothly without affecting your site’s speed or performance.</li>
<li>Free Features: Includes system details, security headers, CAPTCHA, and 2FA to monitor and protect your site.</li>
</ul>
<h3>Features</h3>
<ul>
<li>
Hide WordPress Version
<ul>
<li>Why: Stops hackers from targeting weaknesses in your WordPress version. </li>
<li>Impact: Good protection with no effect on your site’s appearance.</li>
</ul>
</li>
<li>
Disable PHP Execution in Uploads Folder
<ul>
<li>Why: Prevents harmful scripts from running if someone uploads a malicious file. </li>
<li>Impact: Strong defense against file-based attacks.</li>
</ul>
</li>
<li>
Prevent User Enumeration
<ul>
<li>Why: Blocks hackers from guessing usernames through sneaky methods. </li>
<li>Impact: Keeps your user list safe from prying eyes.</li>
</ul>
</li>
<li>
Detect & Warn About “admin” Username
<ul>
<li>Why: Alerts you if your site uses the risky “admin” username. </li>
<li>Impact: Big security boost if you change the username.</li>
</ul>
</li>
<li>
Disable File Editing in Dashboard
<ul>
<li>Why: Stops anyone from modifying your site’s code through the WordPress dashboard. </li>
<li>Impact: Major safeguard against unauthorized code changes.</li>
</ul>
</li>
<li>
Force HTTPS for Login & Admin
<ul>
<li>Why: Ensures your login and admin pages use a secure connection. </li>
<li>Impact: Critical for keeping your credentials safe.</li>
</ul>
</li>
<li>
Basic Brute Force Protection (Lite)
<ul>
<li>Why: Temporarily blocks repeated failed login attempts. </li>
<li>Impact: Strong protection against login attacks.</li>
</ul>
</li>
<li>
System Details
<ul>
<li>Why: Shows important info about your site to monitor its health. </li>
<li>Impact: Keeps you informed about your site’s status.</li>
</ul>
</li>
<li>
Security Headers
<ul>
<li>Why: Adds HTTP headers to improve your site’s security. </li>
<li>Impact: Strengthens your site’s defense with minimal setup.</li>
</ul>
</li>
<li>
CAPTCHA Protection (Cloudflare Turnstile)
<ul>
<li>Why: Adds CAPTCHA to prevent spam and bot submissions. </li>
<li>Impact: Enhances form security with user-friendly CAPTCHA.</li>
</ul>
</li>
<li>
Two-Factor Authentication (2FA)
<ul>
<li>Why: Adds an extra layer of security by requiring a second verification step during login. </li>
<li>Impact: Significantly reduces the risk of unauthorized access. </li>
</ul>
</li>
</ul>
2FA Features: 
– Authenticator App (TOTP): Use apps like Google Authenticator or Authy for time-based codes. 
– Email 2FA: Receive codes via email for verification. 
– Recovery Codes: Generate emergency codes for access if other methods are unavailable. 
– Per-User Settings: Each user can configure their own 2FA preferences. 
– Multisite Support: Super admins can enforce 2FA network-wide. 
– Flexible Options: Choose primary 2FA method from TOTP, Email 2FA, or Recovery Codes.
Supported Forms, Plugins & Multisite for CAPTCHA: 
– Core WordPress: Login, Registration, Lost Password, Comment 
– E-commerce & Membership: WooCommerce Checkout, MemberPress, Ultimate Member, WP-Members 
– Form Plugins: WPForms, Gravity Forms, Contact Form 7 (CF7), Formidable Forms, Forminator, Elementor Pro, Easy Digital Downloads (EDD), Mailchimp for WordPress 
– Community / Forums: BuddyPress, bbPress 
– Multisite: Multisite Signup Forms
<h3>How to Set Up CAPTCHA with Cloudflare Turnstile</h3>
<ol>
<li>Sign Up for Cloudflare: Go to https://www.cloudflare.com/ and create a free account or log in. </li>
<li>Add Your Site: Click “Add a Site” in the dashboard and enter your domain. </li>
<li>Access Turnstile: Navigate to the “Turnstile” section in the Cloudflare dashboard. </li>
<li>Create a Turnstile Widget:
<ul>
<li>Click “Add Widget” </li>
<li>Provide a name (e.g., “SecurelyWP CAPTCHA”) </li>
<li>Add Hostnames (your domain, e.g., example.com) → Click “Add” </li>
<li>Choose the widget type (“Managed”) </li>
</ul>
</li>
<li>Get Your Keys: Copy the Site Key and Secret Key. </li>
<li>Add Keys to SecurelyWP: Go to SecurelyWP > CAPTCHA Settings in WordPress → paste keys → enable CAPTCHA for desired forms. </li>
<li>Test Your CAPTCHA: Visit a form to ensure the CAPTCHA widget appears and works correctly.</li>
</ol>
<h3>How to Set Up Two-Factor Authentication</h3>
<ol>
<li>Access 2FA Settings: Go to “Profile” > “Two-Factor Authentication” in your WordPress dashboard. </li>
<li>Enable 2FA Methods:
<ul>
<li>Authenticator App: Scan the QR code or enter the secret into your app (Google Authenticator, Authy). Verify with a code. </li>
<li>Email 2FA: Enable to receive codes via email. </li>
<li>Recovery Codes: Generate emergency codes. Copy or download codes for safekeeping. </li>
</ul>
</li>
<li>Choose Primary Method: Select your preferred 2FA method (Authenticator App, Email, or Recovery Codes). </li>
<li>Test 2FA: Log out and log in to verify the 2FA prompt appears below the login form. </li>
<li>Multisite (Super Admins): Enable network-wide 2FA enforcement for all users.</li>
</ol>

SecurelyWP – all-in-one security

SecurelyWP is a simple security plugin that protects your WordPress site right after activation—no setup needed for most features.

Steel Security & Hardening – Site Audit Tools vs SecurelyWP – all-in-one security