Webmasters.Team

WT Hardening is a lightweight, modular security plugin that turns on the most important WordPress hardening measures without modifying your theme, <code>wp-config.php</code>, or <code>.htaccess</code>. Everything works through WordPress hooks and can be disabled at any moment with a single click.
The plugin is completely free, without a PRO version, without ads, and without sending data to external servers. Built by the <a href="https://webmasters.team" rel="nofollow ugc">webmasters.team</a> crew for daily WordPress work.
<h4>Modules</h4>
<ul>
<li>XML-RPC — blocks <code>xmlrpc.php</code> (403) and filters the XML-RPC methods. Stops brute-force attacks through the most attacked WordPress endpoint.</li>
<li>User enumeration — hides logins by blocking <code>/wp/v2/users</code> in the REST API for unauthenticated users.</li>
<li>Author archive — redirects <code>/?author=1</code> to the homepage (another enumeration vector).</li>
<li>Hide WP version — removes the <code><meta name="generator"></code> tag, <code>?ver=</code> query strings from assets, and redundant meta tags (wlwmanifest, rsd, shortlink).</li>
<li>X-Pingback — removes the <code>X-Pingback</code> HTTP header from all responses.</li>
<li>Login errors — replaces the specific “wrong login / wrong password” messages with a single generic text (does not reveal whether a login exists).</li>
<li>Login limiter — blocks an IP for X minutes after N failed attempts. Data lives in a dedicated table (not <code>wp_options</code>), with hourly cleanup of old entries.</li>
<li>File editor — sets <code>DISALLOW_FILE_EDIT</code>, hiding the theme and plugin editor in the admin (an attacker who compromises an account cannot inject a backdoor through the browser).</li>
<li>Password policy — enforces minimum length and complexity (upper and lower case, digits, optionally symbols) for profile updates, registration, and password reset.</li>
<li>Security HTTP headers — <code>X-Frame-Options</code>, <code>X-Content-Type-Options</code>, <code>Referrer-Policy</code>, <code>Permissions-Policy</code>, optionally <code>HSTS</code> (use with care — browsers cache it for a year).</li>
<li>Event log — records logins (successful and failed), registrations, user changes, plugin activations and deactivations, theme switches, and settings updates. Retention defaults to 30 days. Visible in the admin panel.</li>
</ul>
<h4>What makes it different</h4>
<ul>
<li>Modular architecture — each module is a separate class and can be disabled in the settings without affecting the others.</li>
<li>Zero external dependencies — no Composer, no vendor lock-in, no cloud APIs.</li>
<li>No data leaves the instance — everything stays in the local MySQL/MariaDB database.</li>
<li>Internationalization ready — full coverage with <code>__()</code>/<code>esc_html__()</code> and a POT file for translators.</li>
<li>Clean uninstall — when the plugin is removed, options, tables, and cron jobs are dropped.</li>
</ul>
<h4>What WT Hardening does NOT do (by design)</h4>
<ul>
<li>Does not scan for malware — that is a different problem, a different toolset.</li>
<li>Does not ship telemetry to the cloud — all data is local.</li>
<li>Does not add a WAF at the application layer — that belongs to the server or CDN.</li>
</ul>
For those needs we recommend dedicated plugins (e.g. Wordfence) or an infrastructure layer (Cloudflare, fail2ban).

WT Hardening

WordPress hardening without touching your theme: XML-RPC, user enumeration, login limiter, security headers, strong passwords, event log.

Freemius

Matt Biscay

Make your WordPress site lightning-fast in minutes. FlashSpeed is the performance optimization plugin trusted by thousands of WordPress and WooCommerce site owners to dramatically improve page load times, boost Core Web Vitals scores, and increase conversions.
<h4>Why Site Speed Matters</h4>
<ul>
<li>53% of mobile users abandon sites that take longer than 3 seconds to load</li>
<li>Every 1-second delay in page load time can reduce conversions by 7%</li>
<li>Google ranks faster sites higher in search results</li>
<li>Faster sites = better user experience = more sales and engagement</li>
</ul>
<h4>What FlashSpeed Does</h4>
FlashSpeed eliminates the bloat that slows down WordPress. Instead of loading dozens of unnecessary scripts, styles, and resources on every page, FlashSpeed gives you granular control over exactly what loads—and what doesn’t.
The result? Faster page loads, improved Core Web Vitals, better SEO rankings, and happier visitors who convert.
<h4>Free Features</h4>
✅ Asset Optimization – Disable unused WordPress assets (emojis, embeds, dashicons, jQuery Migrate) 
✅ Google Fonts & Maps Control – Block or optimize Google Fonts and Google Maps loading 
✅ Meta Tag Management – Remove unnecessary meta tags (RSD, WLW, shortlinks, generator tags) 
✅ Pingback Protection – Disable pingbacks to prevent spam and reduce server load 
✅ Custom Favicon – Set unique favicons for frontend and backend 
✅ Self-Ping Prevention – Stop WordPress from pinging itself 
✅ Query String Removal – Remove version strings from CSS/JS for better caching 
✅ Password Strength Meter – Disable on non-essential pages to save resources
<h4>Pro Features – Take Performance to the Next Level</h4>
Upgrade to <a href="https://utopique.net/products/flash-speed-pro/" title="FlashSpeed Pro" rel="nofollow ugc">FlashSpeed Pro</a> for advanced optimization and security features:
⚡ Instant Page Preloading – Preload pages before users click for instant navigation 
⚡ Local Google Analytics – Host GA4 locally for faster loading and better privacy compliance 
⚡ Security Headers – Add CSP, HSTS, X-Frame-Options, and other security headers 
⚡ Custom Code Injection – Add tracking codes and scripts without editing theme files 
⚡ Post Revision Control – Limit revisions to keep your database lean and fast 
⚡ Advanced Tweaks – Remove jQuery, enforce SSL, convert URLs to protocol-relative 
⚡ Resource Hints – Add preconnect and preload hints for critical resources 
⚡ Agency Features – Client controls, update management, email notification settings
<h4>Perfect For</h4>
<ul>
<li>🛒 WooCommerce stores wanting faster checkout and higher conversions</li>
<li>📝 Content sites needing better Core Web Vitals and SEO rankings</li>
<li>🎨 Agencies managing multiple client sites with granular control</li>
<li>💼 Business sites where every second of load time impacts revenue</li>
<li>🚀 Anyone who wants a faster WordPress site without technical complexity</li>
</ul>
<h4>What Users Are Saying</h4>
“FlashSpeed reduced our page load time from 4.2s to 1.8s. Our bounce rate dropped by 35%!”
“Finally, a performance plugin that actually works and doesn’t break my site.”
“The Pro version paid for itself in the first month with increased conversions.”
<h4>Easy Setup, Instant Results</h4>
<ol>
<li>Install and activate FlashSpeed</li>
<li>Visit the FlashSpeed settings page</li>
<li>Toggle the optimizations you want</li>
<li>Watch your site speed improve instantly</li>
</ol>
No complicated configuration. No technical knowledge required. Just fast results.
<h4>Compatibility</h4>
<ul>
<li>✅ WordPress 6.0+</li>
<li>✅ WooCommerce 3.3+</li>
<li>✅ PHP 7.4+</li>
<li>✅ Works with all themes and page builders</li>
<li>✅ Compatible with popular caching plugins</li>
</ul>
<h4>Support & Documentation</h4>
Need help? We’ve got you covered:
<ul>
<li>📚 Comprehensive documentation</li>
<li>💬 Fast, friendly support team</li>
<li>🔄 Regular updates and improvements</li>
<li>🛡️ Security-first development approach</li>
</ul>
Ready to make your WordPress site blazing fast? Install FlashSpeed now and see the difference speed makes.

FlashSpeed – Speed Optimization & Performance Booster

Speed up WordPress & WooCommerce sites instantly. Disable unused assets, optimize Core Web Vitals, add security headers. Boost SEO & conversions.

WT Hardening vs FlashSpeed – Speed Optimization & Performance Booster