Webmasters.Team

WT Hardening is a lightweight, modular security plugin that turns on the most important WordPress hardening measures without modifying your theme, <code>wp-config.php</code>, or <code>.htaccess</code>. Everything works through WordPress hooks and can be disabled at any moment with a single click.
The plugin is completely free, without a PRO version, without ads, and without sending data to external servers. Built by the <a href="https://webmasters.team" rel="nofollow ugc">webmasters.team</a> crew for daily WordPress work.
<h4>Modules</h4>
<ul>
<li>XML-RPC — blocks <code>xmlrpc.php</code> (403) and filters the XML-RPC methods. Stops brute-force attacks through the most attacked WordPress endpoint.</li>
<li>User enumeration — hides logins by blocking <code>/wp/v2/users</code> in the REST API for unauthenticated users.</li>
<li>Author archive — redirects <code>/?author=1</code> to the homepage (another enumeration vector).</li>
<li>Hide WP version — removes the <code><meta name="generator"></code> tag, <code>?ver=</code> query strings from assets, and redundant meta tags (wlwmanifest, rsd, shortlink).</li>
<li>X-Pingback — removes the <code>X-Pingback</code> HTTP header from all responses.</li>
<li>Login errors — replaces the specific “wrong login / wrong password” messages with a single generic text (does not reveal whether a login exists).</li>
<li>Login limiter — blocks an IP for X minutes after N failed attempts. Data lives in a dedicated table (not <code>wp_options</code>), with hourly cleanup of old entries.</li>
<li>File editor — sets <code>DISALLOW_FILE_EDIT</code>, hiding the theme and plugin editor in the admin (an attacker who compromises an account cannot inject a backdoor through the browser).</li>
<li>Password policy — enforces minimum length and complexity (upper and lower case, digits, optionally symbols) for profile updates, registration, and password reset.</li>
<li>Security HTTP headers — <code>X-Frame-Options</code>, <code>X-Content-Type-Options</code>, <code>Referrer-Policy</code>, <code>Permissions-Policy</code>, optionally <code>HSTS</code> (use with care — browsers cache it for a year).</li>
<li>Event log — records logins (successful and failed), registrations, user changes, plugin activations and deactivations, theme switches, and settings updates. Retention defaults to 30 days. Visible in the admin panel.</li>
</ul>
<h4>What makes it different</h4>
<ul>
<li>Modular architecture — each module is a separate class and can be disabled in the settings without affecting the others.</li>
<li>Zero external dependencies — no Composer, no vendor lock-in, no cloud APIs.</li>
<li>No data leaves the instance — everything stays in the local MySQL/MariaDB database.</li>
<li>Internationalization ready — full coverage with <code>__()</code>/<code>esc_html__()</code> and a POT file for translators.</li>
<li>Clean uninstall — when the plugin is removed, options, tables, and cron jobs are dropped.</li>
</ul>
<h4>What WT Hardening does NOT do (by design)</h4>
<ul>
<li>Does not scan for malware — that is a different problem, a different toolset.</li>
<li>Does not ship telemetry to the cloud — all data is local.</li>
<li>Does not add a WAF at the application layer — that belongs to the server or CDN.</li>
</ul>
For those needs we recommend dedicated plugins (e.g. Wordfence) or an infrastructure layer (Cloudflare, fail2ban).

WT Hardening

WordPress hardening without touching your theme: XML-RPC, user enumeration, login limiter, security headers, strong passwords, event log.

Guerric MERLE

Nexsol Technologies

Victor Lago de Lira

Maxime F.

The WordSentinel plugin by Nexsol Technologies Sàrl enhances your WordPress website’s security by automatically applying and managing HTTP security headers — including Content Security Policy (CSP) — while providing live security analysis powered by Mozilla Observatory.
Unlike simple header managers, WordSentinel actively helps you understand, measure, and improve your site’s protection. 
It provides clear dashboards, actionable insights, and real-time grading so you can reinforce your headers with confidence — no deep technical knowledge required.
<h4>What WordSentinel Does</h4>
WordSentinel helps protect your WordPress website against common web vulnerabilities such as: 
– Cross-Site Scripting (XSS) 
– Clickjacking attacks 
– Content injection and mixed content issues 
– Insecure resource loading (scripts, iframes, styles)
It does so by implementing a complete and configurable set of browser-level security headers, giving you granular control over each directive.
In addition, it connects securely to Mozilla Observatory to scan your site and assign a security grade (A+ to F), helping you benchmark your configuration and understand what needs improvement.
<h4>Key Features</h4>
<ul>
<li>
Comprehensive HTTP Header Management 
Easily configure headers such as:
<ul>
<li>Content Security Policy (CSP) </li>
<li>Strict-Transport-Security (HSTS) </li>
<li>X-Frame-Options </li>
<li>Referrer-Policy </li>
<li>X-Content-Type-Options </li>
<li>Permissions-Policy </li>
</ul>
</li>
<li>
Real-Time Security Analysis 
Instantly scan your site via Mozilla Observatory and get a visual security grade. 
The plugin automatically handles rate limits with built-in cooldown protection.
</li>
<li>
Advanced CSP Management 
Create, test, and refine your CSP rules dynamically. 
WordSentinel now supports automatic hash generation for inline scripts and styles, improving both flexibility and security.
</li>
<li>
Smart License and Subscription System 
The free version covers essential headers and analysis. 
Premium users unlock advanced CSP tools, automatic reports, and custom integrations. 
Licenses are securely validated through Nexsol’s API and cached locally for 24 hours.
</li>
<li>
Optimized for Local and Production Environments 
Automatically detects if you are running on localhost and disables API calls for safe testing.
</li>
<li>
Performance and Privacy First 
WordSentinel is lightweight, privacy-respecting, and runs entirely within WordPress. 
No telemetry, analytics, or tracking are ever collected.
</li>
<li>
Multilingual and Accessible Interface 
Translated into six languages with an adaptive design inspired by Mozilla’s clean security aesthetic.
</li>
</ul>
<h4>Why Choose WordSentinel?</h4>
<ul>
<li>Easy setup — no coding skills required </li>
<li>Combines security headers and observatory analysis in one plugin </li>
<li>Works seamlessly with most WordPress security and caching plugins </li>
<li>Developed and maintained by Nexsol Technologies, a Swiss-based IT company </li>
<li>Transparent, privacy-respecting, and GPL-licensed</li>
</ul>
WordSentinel merges modern web security standards with a simple and intuitive configuration experience — making it a must-have for both developers and site owners who care about protection and compliance.
<h3>External Services and API Usage</h3>
WordSentinel securely connects to a small number of external APIs to perform license validation and site analysis:
<ul>
<li>
Mozilla Observatory API – Used to analyze your website’s HTTP headers and generate a public security grade. 
Data sent: only your site’s public URL. 
Service: https://observatory.mozilla.org/api/
</li>
<li>
Nexsol License Validation API – Used to verify premium licenses and maintain secure feature access. 
Data sent: license key only. 
Service: https://api.nexsol-tech.ch/wordsentinel/licenses
</li>
<li>
Nexsol Public Key API – Used to securely retrieve the public keys required for validating license signatures. 
Data sent: none. 
Service: https://api.nexsol-tech.ch/wordsentinel/certs
</li>
</ul>
All requests are transmitted securely via HTTPS. 
WordSentinel never sends personal information, usage analytics, or tracking data of any kind.
<h3>Languages Supported</h3>
<ul>
<li>English (default)</li>
<li>Français (fr_FR)</li>
<li>Deutsch (de_DE)</li>
<li>Italiano (it_IT)</li>
<li>Español (es_ES)</li>
<li>Português Brasileiro (pt_BR)</li>
</ul>
<h3>License</h3>
This plugin is licensed under the GPLv2 or later. 
See the GPLv2 License for details: https://www.gnu.org/licenses/gpl-2.0.html
<h3>Support</h3>
For documentation, updates, and premium features, visit https://nexsol-tech.ch/wordsentinel

WordSentinel

Secure your WordPress website with advanced HTTP headers, intelligent CSP management, and integrated Mozilla Observatory security analysis.

WT Hardening vs WordSentinel