2026-07-24 07:55:53 +02:00 · 2026-01-25 20:21:17 +01:00
commit 9f06a4c2a2
24 changed files with 9192 additions and 0 deletions
@@ -0,0 +1,145 @@
=== WP Security Pack ===
Contributors: arkhost
Tags: security, login, firewall, 2fa, malware
Requires at least: 5.0
Tested up to: 6.4
Requires PHP: 7.4
Stable tag: 1.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html
A security plugin. No upsells, no premium version, no "threat counters". Just security settings that work.
== Description ==
WP Security Pack adds security features to WordPress. It's free, open source, and doesn't nag you to upgrade.
**What it does:**
= Login Protection =
* Limit login attempts (block IPs after failed logins)
* Custom login URL (hide wp-login.php)
* Hide wp-admin from non-logged-in users
* Honeypot field to catch bots
* Hide login error messages to prevent username enumeration
* Email alerts when admins log in from new IPs
* Restrict login page access by country or IP
= IP Control =
* Whitelist IPs (always allowed)
* Blacklist IPs (always blocked)
* Auto-blacklist IPs after repeated lockouts
* Supports IPv4, IPv6, and CIDR notation
= Geo Blocking =
* Block access from specific countries
* Uses free IP2Location LITE database
* One-click database download
= Hardening =
* Disable XML-RPC
* Disable file editing in dashboard
* Disable application passwords
* Restrict REST API to logged-in users
* Remove WordPress version from source
* Disable user enumeration (?author=1 and REST API)
* Disable pingbacks and trackbacks
= Security Headers =
* X-Content-Type-Options
* X-Frame-Options
* X-XSS-Protection
* Referrer-Policy
* Permissions-Policy
* Content-Security-Policy
* Strict-Transport-Security (HSTS)
= Two-Factor Authentication =
* TOTP-based (works with Google Authenticator, Authy, etc.)
* Backup codes
* Option to enforce 2FA for administrators
= File Integrity Monitoring =
* Monitors WordPress core files
* Compares against official WordPress.org checksums
* Daily automatic scans
* Email alerts when files change
= Malware Scanner =
* Scans plugins, themes, and uploads
* Pattern-based detection for common threats
* Does not scan WordPress core (use File Integrity for that)
* Weekly automatic scans
= Activity Log =
* Records login attempts (success and failed)
* Records lockouts and blocks
* Shows IP, country, username, timestamp
* Configurable retention period
* Export to CSV
= Tools =
* Export/import settings
* Force logout all users
* Test email delivery
**What it doesn't do:**
* Firewall at the server level (use your host's firewall)
* Real-time threat intelligence (we don't phone home)
* Backup your site (use a backup plugin)
* CDN or performance optimization
**Privacy:**
The plugin doesn't send data anywhere except:
* WordPress.org API to verify core file checksums
* IP2Location to download the geo database (if you click the download button)
No tracking, no analytics, no telemetry.
== Installation ==
1. Upload the plugin files to `/wp-content/plugins/wp-security-pack/`
2. Activate the plugin through the 'Plugins' screen
3. Go to Security in the admin menu to configure
== Frequently Asked Questions ==
= Is there a premium version? =
No. This is the complete plugin.
= Will this slow down my site? =
The plugin runs security checks on specific actions (login, admin access). It doesn't add overhead to frontend page loads for regular visitors.
= I locked myself out =
Connect to your server via FTP or SSH and rename the plugin folder. This disables the plugin and you can log in normally.
= Does geo-blocking work without the database? =
No. You need to download the IP2Location LITE database from the plugin settings. It's free.
= Can I use this with other security plugins? =
Probably, but there may be conflicts. We recommend using one security plugin at a time.
== Screenshots ==
1. Status overview
2. Login protection settings
3. Activity log
4. Two-factor authentication setup
== Changelog ==
= 1.0 =
* Initial release
== Upgrade Notice ==
= 1.0 =
Initial release.