Webmasters.Team

WT Hardening is a lightweight, modular security plugin that turns on the most important WordPress hardening measures without modifying your theme, <code>wp-config.php</code>, or <code>.htaccess</code>. Everything works through WordPress hooks and can be disabled at any moment with a single click.
The plugin is completely free, without a PRO version, without ads, and without sending data to external servers. Built by the <a href="https://webmasters.team" rel="nofollow ugc">webmasters.team</a> crew for daily WordPress work.
<h4>Modules</h4>
<ul>
<li>XML-RPC — blocks <code>xmlrpc.php</code> (403) and filters the XML-RPC methods. Stops brute-force attacks through the most attacked WordPress endpoint.</li>
<li>User enumeration — hides logins by blocking <code>/wp/v2/users</code> in the REST API for unauthenticated users.</li>
<li>Author archive — redirects <code>/?author=1</code> to the homepage (another enumeration vector).</li>
<li>Hide WP version — removes the <code><meta name="generator"></code> tag, <code>?ver=</code> query strings from assets, and redundant meta tags (wlwmanifest, rsd, shortlink).</li>
<li>X-Pingback — removes the <code>X-Pingback</code> HTTP header from all responses.</li>
<li>Login errors — replaces the specific “wrong login / wrong password” messages with a single generic text (does not reveal whether a login exists).</li>
<li>Login limiter — blocks an IP for X minutes after N failed attempts. Data lives in a dedicated table (not <code>wp_options</code>), with hourly cleanup of old entries.</li>
<li>File editor — sets <code>DISALLOW_FILE_EDIT</code>, hiding the theme and plugin editor in the admin (an attacker who compromises an account cannot inject a backdoor through the browser).</li>
<li>Password policy — enforces minimum length and complexity (upper and lower case, digits, optionally symbols) for profile updates, registration, and password reset.</li>
<li>Security HTTP headers — <code>X-Frame-Options</code>, <code>X-Content-Type-Options</code>, <code>Referrer-Policy</code>, <code>Permissions-Policy</code>, optionally <code>HSTS</code> (use with care — browsers cache it for a year).</li>
<li>Event log — records logins (successful and failed), registrations, user changes, plugin activations and deactivations, theme switches, and settings updates. Retention defaults to 30 days. Visible in the admin panel.</li>
</ul>
<h4>What makes it different</h4>
<ul>
<li>Modular architecture — each module is a separate class and can be disabled in the settings without affecting the others.</li>
<li>Zero external dependencies — no Composer, no vendor lock-in, no cloud APIs.</li>
<li>No data leaves the instance — everything stays in the local MySQL/MariaDB database.</li>
<li>Internationalization ready — full coverage with <code>__()</code>/<code>esc_html__()</code> and a POT file for translators.</li>
<li>Clean uninstall — when the plugin is removed, options, tables, and cron jobs are dropped.</li>
</ul>
<h4>What WT Hardening does NOT do (by design)</h4>
<ul>
<li>Does not scan for malware — that is a different problem, a different toolset.</li>
<li>Does not ship telemetry to the cloud — all data is local.</li>
<li>Does not add a WAF at the application layer — that belongs to the server or CDN.</li>
</ul>
For those needs we recommend dedicated plugins (e.g. Wordfence) or an infrastructure layer (Cloudflare, fail2ban).

WT Hardening

WordPress hardening without touching your theme: XML-RPC, user enumeration, login limiter, security headers, strong passwords, event log.

Daev.tech

Unified aims to provide standard functionality that almost all sites use or should use, such as page caching, clean responses, custom SMTP and good security.
Our current features:
<ul>
<li>Email log
<ul>
<li>Searchable list of email sent from the site, where emails content can be viewed, re-send and more.</li>
</ul>
</li>
<li>Email Queue
<ul>
<li>Never make the user wait for emails being sent by the system again, where it might fail</li>
<li>Queue emails and send the emails in the background instead, with support for retrying when mails cant be sent.</li>
</ul>
</li>
<li>Page caching
<ul>
<li>Very fast page caching – Just enable and we take care of the rest</li>
<li>WooCommerce support</li>
</ul>
</li>
<li>SMTP setup
<ul>
<li>Configure a custom SMTP server to send your emails through</li>
</ul>
</li>
<li>Clean-up
<ul>
<li>Clean up the response generated by WordPress</li>
</ul>
</li>
<li>Security
<ul>
<li>Configure security headers to make your site more safe</li>
<li>Enable header X-Frame-Options</li>
<li>Enable header X-Content-Type-Options</li>
<li>Enable header Referrer-Policy</li>
<li>Enable header Strict-Transport-Security (HSTS)</li>
</ul>
</li>
</ul>
Our goal is to make the functionality simple, with high performance and low memory footprint, over the cost, which is that it can not support all the same features as the specialized plugins.
But the argument here is that simplicity, high performance, low memory usage and easy setup is more important than frontend users gets served 10ms faster with the bloated specialized plugins.
Having specialized plugins for common functional needs could seem like a good idea, but they are often over-engineered and bloated. 
Each plugin often has its own libraries loaded, configurations, files and more to make it work.
So you have to configure them in different places and they may not even work well together.
Also, having many plugins, tend to make to the admin section (/wp-admin) very slow, as it often loads the entire world in all plugins, each of them checking their licenses etc.
What if Unified doesnt support feature X that I need?
Unified does not intend to be the plugin with all functionality, but only the have the basics with high performance. 
But we would appreciate your input, if you feel like something is missing. Please contact <a href="mailto:support@daev.tech" rel="nofollow ugc">support@daev.tech</a> for the details.
As example, if you need another SMTP plugin with a certain feature set, you can just install that and disable it in Unified. 
When you disable features in Unified, you really disable it, so that it no longer loads anything.
<h3>Plan for Unified</h3>
We have great plans for Unified and many features planned already.
Our ultimate vision for Unified, is that our users use Unified as a base plugin on their sites, to cover most of the standard functionality that most sites use.

Unified – Email Log, Email Queue, Page cache and more

Unified is a plugin that combines functionalities that most sites use, all in one plugin, with a sharp focus on high performance and low memory usage.

WT Hardening vs Unified – Email Log, Email Queue, Page cache and more