Store Prose

A lightweight WordPress security plugin to prevent brute force attacks and disable XML-RPC.
<h3>What can you do with WordShield?</h3>
<ul>
<li>Brute Force Protection</li>
<li>Disable XML-RPC API exploits</li>
<li>Change default Login URL –Planned</li>
<li>Add Security Headers –Planned</li>
<li>Content Protection –Planned</li>
<li>Login Security –Planned</li>
<li>Hide Generator Tags</li>
<li>Disable PHP Editing</li>
</ul>
<h3>Future Roadmap</h3>
<ul>
<li>Stop user enumerations.</li>
<li>Request rate throttler.</li>
<li>Prevent comment spam.</li>
<li>IP Ban.</li>
<li>Prevent code execution.</li>
<li>2FA</li>
<li>Backup & Restore.</li>
<li>Support for multisite.</li>
<li>Logs, Notifications, and more!</li>
</ul>
<h3>Note:</h3>
The current version of the WordShield Security plugin does not work in a multisite environment.
<h3>Advantages of WordShield Security Plugin</h3>
<ul>
<li>Lean Code— Unlike most other Security Plugins, WordShield focuses on the core functionalities and has zero bloat.</li>
<li>Ultrafast— This lightweight plugin adds negligible overhead to your website. Each new release is tested for performance before making it available for general use. </li>
<li>It added only 0.004 seconds of execution time in our internal performance profiling tests.*</li>
<li>Failsafe— This WordPress security plugin does not modify any core file. It does not alter the .htaccess file as well. With easy-to-use recovery options, you can be sure that your WordPress website will never break.</li>
<li>Best Practices— WordShield follows WordPress best practices and respects the coding standards.</li>
<li>Maintenance & Support— WordShield has a planned roadmap for the future. It is well-supported and updated for compatibility with each WordPress upgrade.</li>
</ul>
<h3>How to Limit Login Attempts in WordPress?</h3>
You can limit login attempts to your WordPress website using the WordShield security plugin. You can prevent Brute Force attacks with the following steps:
<ul>
<li>Open the settings screen after installing and activating the plugin.</li>
<li>Navigate to the Brute Force tab on the settings screen.</li>
<li>Set the maximum number of invalid attempts you want to allow for each user.</li>
<li>Set the time (in minutes) you want to lock a user account after exceeding the maximum number of invalid attempts.</li>
<li>If you do not want to prevent Brute Force attacks, select 0 for both of these settings.</li>
<li>Save the settings.</li>
</ul>
👉 The WordShield security plugin informs the user about the remaining retries before the account becomes locked. 
👉 If an account gets locked, WordShield informs the user about the time to wait before trying to log in again. 
👉 You can customize the default error messages in any language by keying in the message in the 2 optional fields. 
👉 Use %%MINUTES_LEFT%% to show the time in minutes in your custom message. Use %%ATTEMPTS_LEFT%% to show the number of retries left in your custom message.
<h3>How to disable XML-RPC API exploits?</h3>
XML-RPC is enabled by default in every WordPress installation. While XML-RPC is necessary for certain services and plugins like Jetpack, it can make websites vulnerable to remote code injection.
You can protect your website from the XML-RPC vulnerability as follows:
<ul>
<li>Open the settings screen after installing and activating the plugin.</li>
<li>Navigate to the XML-RPC tab on the settings screen.</li>
<li>Check the Disable XML-RPC checkbox to disable XML-RPC completely.</li>
<li>If you are using JetPack, you can select the Enable Jetpack access so that the Jetpack plugin continues to work seamlessly.</li>
<li>If you need specific IPs to access XML-RPC API, key in the comma-separated list of IPs in the Whitelisted IPs field.</li>
<li>Save the settings.</li>
</ul>
<h3>How to Hide the Generator tags in WordPress?</h3>
WordPress and WooCommerce generator tags let the potential attackers can easily identify the specific version of WordPress (or WooCommerce) you are using. This, in turn, exposes technical vulnerabilities thereby making your site more susceptible to hacking attempts.
You can hide the generator tags in WordPress by the following steps.
<ul>
<li>Open the settings screen after installing and activating the plugin.</li>
<li>Navigate to the Extras tab on the settings screen.</li>
<li>Select the checkbox Remove Generator tags.</li>
<li>Save the settings.</li>
</ul>
<h3>How to disable PHP editing?</h3>
You can disable PHP editing to prevent accidental changes in plugins and themes causing a complete system crash.
You can disable PHP editing with the following steps:
<ul>
<li>Open the settings screen after installing and activating the plugin.</li>
<li>Navigate to the Extras tab on the settings screen.</li>
<li>Select the checkbox Disable PHP editing.</li>
<li>Select the checkbox Disable theme change if you want to hide the Appearance menu as well.</li>
<li>Save the settings.</li>
</ul>

WordPress Security Plugin – WordShield

A lightweight WordPress security plugin to prevent brute force attacks and disable XML-RPC.

Shahjahan Jewel

WPManageNinja

Mahmudul Hasan Arif

Boost Your Website’s Security with Login/Signup Security, Two-Factor Email Authentication, Login/Logout Redirects, Social Logins, Detailed Audit Logs, and More. FluentAuth is the lightest and blazing fast security plugin for WordPress.
Highlighted Features
<ul>
<li>Two-Factor Authentication for Login</li>
<li>Magic Login via Email</li>
<li>Social Login / Register</li>
<li>Limit Login Attempts</li>
<li>Dynamic Login Redirects</li>
<li>Detailed Audit Logs</li>
<li>Core Security Enhancement</li>
<li>Security Email Notifications</li>
<li>Super Fast Solution</li>
<li>Restrict /wp-admin for low level user roles</li>
</ul>
What’s new in version 2.0
<iframe loading="lazy" class="youtube-player" width="750" height="422" src="https://www.youtube.com/embed/P_vREW7s2B4?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent" allowfullscreen="true" style="border:0;" sandbox="allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox"></iframe>
<iframe loading="lazy" class="youtube-player" width="750" height="422" src="https://www.youtube.com/embed/5t_8rvtrkk4?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent" allowfullscreen="true" style="border:0;" sandbox="allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox"></iframe>
🚀 Two-Factor Authentication for Login 
Ensure secure access to your admin panel with Two-Factor Login via email for high-level user roles like Administrator / Editor. Even if a password gets compromised, only the right person will be able to log in with the additional authentication step.
🚀 Magic Login via Email 
Simplify the login process for end users like customers and subscribers. No more password resets or forgotten passwords that cause users to leave your site. With our improved flow and features, users can log in to your site simply by typing their username or email address and clicking on a secure one-time use link sent to their email.
🚀 Social Login / Register 
Allow users to log in to your site with their GitHub, Facebook or Google accounts. This feature is lightweight and easy to enable.
🚀 Limit Login Attempts 
Protect your site against brute force attacks by blocking excessive login attempts. Our simple yet powerful tools also improve site security and performance, and allow for customizable lockout timings.
🚀 Dynamic Login Redirects 
Easily redirect users to specific pages after they log in or log out. Our drag-and-drop builder lets you customize the login and logout flow for different types of businesses.
🚀 Detailed Audit Logs 
Track exactly when users log in to your site and via which method (normal login form, magic URL, or social media) with our powerful audit logs.
🚀 Core Security Enhancement 
XML-RPC is a common target for WordPress attacks, but most sites don’t actually need it. This plugin enables you to disable XML-RPC, Remote Application Login, and protect the wp-users listing for REST API for enhanced security.
🚀 Security Email Notifications 
As a business owner, it’s important to know when high-level users like administrators, editors, and authors log in to your site, or if someone unauthorized is trying to log in. Our plugin includes email notifications to alert you of these events.
🚀 Super Fast Solution 
We’ve built this plugin to be super-fast and simple yet powerful, using the latest technologies like WordPress REST-API, VueJS V3, Vue-Router, and Element-Plus for UI building. We also use custom database tables to store audit logs, so they don’t interfere with your default WordPress database tables.
🚀 Restrict /wp-admin for low level user roles 
If you want to restrict /wp-admin access for subscribers or other low level user roles then you can easily enable that and select the user roles that you want to restrict /wp-admin access.
🚀 Customize WordPress Signup Emails 
Customize the WordPress default signup emails with your own branding and content. This feature allows you to create a more personalized experience for your users, enhancing their engagement with your site.
🚀 Custom Login/Signup Shortcodes 
Create custom login and signup forms using shortcodes. This feature allows you to easily integrate login and signup forms into your pages or posts, providing a seamless user experience.
🚀 Disable Admin Email Notifications on User Signup 
Disable the default WordPress admin email notifications that are sent when a new user signs up. This feature helps you manage your email notifications more effectively, reducing clutter in your inbox.
🚀 Scan WordPress Core File Changes 
FluentAuth includes a feature to scan WordPress core files for changes, helping you identify any unauthorized modifications. This is crucial for maintaining the integrity of your WordPress installation and ensuring that your site remains secure.
<h3>Why FluentAuth?</h3>
To improve the security and user experience of a WordPress website, the default authentication system may need to be enhanced with additional plugins. One common issue that WordPress site owners face is their site getting hacked. This is often due to hackers using brute-force attacks to guess passwords and gain access to the admin panel, leading to site takeover. Additionally, the use of common passwords on multiple sites can put all of them at risk if one password is compromised.
Using multiple security plugins can be detrimental to the performance of a WordPress website. These plugins, which are often bloated, intercept every WordPress request and run it through a large number of unnecessary rules, resulting in increased server resource usage and slower site performance. To avoid this issue, consider using a comprehensive security solution that offers multiple features in one package, instead of relying on multiple individual plugins. This will help save server resources and improve the overall performance of your website.
To Solve these issues, we decided to build FluentAuth and made it free.
<h3>Replace Multiple Plugins with FluentAuth</h3>
FluentAuth has been designed to provide light-weight security solution while adding better UX and performance of your site. If you use FluentAuth then you don’t need the following plugins
For Login Limit and ban brute force attacks
<ul>
<li>Limit Login Attempts Reloaded</li>
<li>WPS Limit Login</li>
</ul>
For Login & Logout Redirections
<ul>
<li>LoginWP (Formerly Peter’s Login Redirect)</li>
<li>Sky Login Redirect</li>
<li>WP Login and Logout Redirect</li>
</ul>
For Login & Logout Redirections
<ul>
<li>LoginWP (Formerly Peter’s Login Redirect)</li>
<li>Sky Login Redirect</li>
<li>WP Login and Logout Redirect</li>
</ul>
For Hide Admin Bar and Access Restriction
<ul>
<li>Hide Admin Bar</li>
<li>Hide Admin Bar Based on User Roles</li>
<li>Auto Hide Admin Bar</li>
<li>Hide Admin Bar from Non-Admins</li>
</ul>
<h3>User Guides</h3>
<ul>
<li><a href="https://fluentauth.com/docs/getting-started/" rel="nofollow ugc">Getting Started with FluentAuth</a></li>
<li><a href="https://fluentauth.com/docs/login-redirects/" rel="nofollow ugc">Login / Logout Redirects</a></li>
<li><a href="https://fluentauth.com/docs/shortcodes/" rel="nofollow ugc">Register/Login Shortcodes in FluentAuth</a></li>
<li><a href="https://fluentauth.com/docs/github-auth-connection/" rel="nofollow ugc">Configure Login with GitHub</a></li>
<li><a href="https://fluentauth.com/docs/google-auth-connection/" rel="nofollow ugc">Configure Login with Google</a></li>
</ul>
<h3>Other Plugins By The Same Team</h3>
<ul>
<li><a href="https://wordpress.org/plugins/fluent-crm/" rel="ugc">FluentCRM – Email Marketing, Newsletter, Email Automation and CRM Plugin for WordPress</a></li>
<li><a href="https://wordpress.org/plugins/fluentform/" rel="ugc">Fluent Forms – Fastest WordPress Form Builder Plugin</a></li>
<li><a href="https://wordpress.org/plugins/ninja-tables/" rel="ugc">Ninja Tables – Best WP DataTables Plugin for WordPress</a></li>
<li><a href="https://wordpress.org/plugins/ninja-charts/" rel="ugc">Ninja Charts – Best WP Charts Plugin for WordPress</a></li>
<li><a href="https://wordpress.org/plugins/wp-payment-form/" rel="ugc">WPPayForm – Stripe Payments Plugin for WordPress</a></li>
<li><a href="https://wordpress.org/plugins/mautic-for-fluent-forms/" rel="ugc">Mautic Integration For Fluent Forms</a></li>
<li><a href="https://wordpress.org/plugins/fluentforms-pdf/" rel="ugc">Fluent Forms PDF – PDF Entries for Fluent Forms</a></li>
<li><a href="https://wordpress.org/plugins/fluent-smtp/" rel="ugc">FluentSMTP – WordPress Mail SMTP, SES, SendGrid, MailGun Plugin</a></li>
</ul>
<h3>CONTRIBUTE</h3>
If you want to contribute to this project or just report a bug, you are more than welcome. Please check repository from <a href="https://github.com/WPManageNinja/fluent-security/" rel="nofollow ugc">Github</a>.

FluentAuth – The Ultimate Authorization & Security Plugin for WordPress


You need to protect your login form from brute force attacks.  Fluent Auth does that and is quick and easy to setup.  I pair it with BBQ on simple sites to cover the basics.  


Easy to Use and Effective

Enhance the Security and User Experience of Your Site with Login/Signup Security, Two-Factor Email Authentication, Social Logins and more...

WordPress Security Plugin – WordShield vs FluentAuth – The Ultimate Authorization & Security Plugin for WordPress