Webmasters.Team

WT Hardening is a lightweight, modular security plugin that turns on the most important WordPress hardening measures without modifying your theme, <code>wp-config.php</code>, or <code>.htaccess</code>. Everything works through WordPress hooks and can be disabled at any moment with a single click.
The plugin is completely free, without a PRO version, without ads, and without sending data to external servers. Built by the <a href="https://webmasters.team" rel="nofollow ugc">webmasters.team</a> crew for daily WordPress work.
<h4>Modules</h4>
<ul>
<li>XML-RPC — blocks <code>xmlrpc.php</code> (403) and filters the XML-RPC methods. Stops brute-force attacks through the most attacked WordPress endpoint.</li>
<li>User enumeration — hides logins by blocking <code>/wp/v2/users</code> in the REST API for unauthenticated users.</li>
<li>Author archive — redirects <code>/?author=1</code> to the homepage (another enumeration vector).</li>
<li>Hide WP version — removes the <code><meta name="generator"></code> tag, <code>?ver=</code> query strings from assets, and redundant meta tags (wlwmanifest, rsd, shortlink).</li>
<li>X-Pingback — removes the <code>X-Pingback</code> HTTP header from all responses.</li>
<li>Login errors — replaces the specific “wrong login / wrong password” messages with a single generic text (does not reveal whether a login exists).</li>
<li>Login limiter — blocks an IP for X minutes after N failed attempts. Data lives in a dedicated table (not <code>wp_options</code>), with hourly cleanup of old entries.</li>
<li>File editor — sets <code>DISALLOW_FILE_EDIT</code>, hiding the theme and plugin editor in the admin (an attacker who compromises an account cannot inject a backdoor through the browser).</li>
<li>Password policy — enforces minimum length and complexity (upper and lower case, digits, optionally symbols) for profile updates, registration, and password reset.</li>
<li>Security HTTP headers — <code>X-Frame-Options</code>, <code>X-Content-Type-Options</code>, <code>Referrer-Policy</code>, <code>Permissions-Policy</code>, optionally <code>HSTS</code> (use with care — browsers cache it for a year).</li>
<li>Event log — records logins (successful and failed), registrations, user changes, plugin activations and deactivations, theme switches, and settings updates. Retention defaults to 30 days. Visible in the admin panel.</li>
</ul>
<h4>What makes it different</h4>
<ul>
<li>Modular architecture — each module is a separate class and can be disabled in the settings without affecting the others.</li>
<li>Zero external dependencies — no Composer, no vendor lock-in, no cloud APIs.</li>
<li>No data leaves the instance — everything stays in the local MySQL/MariaDB database.</li>
<li>Internationalization ready — full coverage with <code>__()</code>/<code>esc_html__()</code> and a POT file for translators.</li>
<li>Clean uninstall — when the plugin is removed, options, tables, and cron jobs are dropped.</li>
</ul>
<h4>What WT Hardening does NOT do (by design)</h4>
<ul>
<li>Does not scan for malware — that is a different problem, a different toolset.</li>
<li>Does not ship telemetry to the cloud — all data is local.</li>
<li>Does not add a WAF at the application layer — that belongs to the server or CDN.</li>
</ul>
For those needs we recommend dedicated plugins (e.g. Wordfence) or an infrastructure layer (Cloudflare, fail2ban).

WT Hardening

WordPress hardening without touching your theme: XML-RPC, user enumeration, login limiter, security headers, strong passwords, event log.

ideasToCode

WordPress security is essential to protect your website from hackers and malicious attacks. Without proper security measures, your site can be vulnerable to data breaches, spam, and unauthorized access. A well-secured WordPress site ensures that your content, user data, and website functionality remain safe from threats.
This plugin boosts your WordPress security with several key features:
<ol>
<li>Security Headers: Adds extra layers of protection by sending security headers with each page load.</li>
<li>Change WP Login Error Message: Hides whether the username or password is incorrect, preventing hackers from easily guessing your login details.</li>
<li>Disable WP REST API: Stops unauthorized access to your site’s data by disabling the REST API for non-logged-in users.</li>
<li>Disable XML-RPC: Blocks XML-RPC functionality to prevent brute force attacks and unauthorized access.</li>
<li>Disable Right-Click: Adds a basic level of protection against copying your site content by disabling right-clicking.</li>
<li>Disable Ctrl+C, Ctrl+X, Ctrl+V, Ctrl+A: It will disable these shortcuts, preventing copying of site content.</li>
<li>Email Alerts on Login: Sends the site admin an email alert every time someone logs into the WordPress dashboard.</li>
<li>Change Default WP-Login URL: Customize your WordPress Login Page URL to any name instead of the default ‘wp-admin.’</li>
</ol>
Special Feature: 
If you’re locked out of your WordPress Dashboard (e.g., forgot the custom login URL), you can deactivate the plugin using a special URL. This allows you to regain access without needing to log in to cPanel or FTP.
Tutorial video
<iframe loading="lazy" class="youtube-player" width="750" height="422" src="https://www.youtube.com/embed/6WOCiDauK8U?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent" allowfullscreen="true" style="border:0;" sandbox="allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox"></iframe>
If you want to learn more about how this plugin works, please check our <a href="https://ideastocode.com/plugins/improve-wp-security-plugin/" rel="nofollow ugc">website – ideastocode.com</a>.
<h3>External services</h3>
This plugin connects to an API to obtain the IP address and country name, which are required to display the details when someone logs in to your WordPress dashboard.
It sends the logged-in user’s IP address and country information when they log in. If you are using WP Login Email Alerts, you are giving consent to use this service. 
This service is provided by ipapi (ipapi.co): <a href="https://ipapi.co/terms/" rel="nofollow ugc">Terms of Service</a>

Improve Website Security

This plugin enhances WordPress security by implementing measures like Security Headers, changing the Login URL, disabling WP JSON API, and more.

WT Hardening vs Improve Website Security