mirror of
https://gitlab.com/ArkHost/WP-Security-Pack.git
synced 2026-07-23 23:45:51 +02:00
104 lines
2.3 KiB
Markdown
104 lines
2.3 KiB
Markdown
# WP Security Pack
|
|
|
|
WordPress security without the bullshit. No upsells, no premium tier, no fake threat counters.
|
|
|
|
## Requirements
|
|
|
|
- WordPress 5.0+
|
|
- PHP 7.4+
|
|
|
|
## What It Does
|
|
|
|
### Login Protection
|
|
- Blocks IPs after failed login attempts
|
|
- Custom login URL (hides wp-login.php)
|
|
- Hides wp-admin from logged-out users
|
|
- Honeypot field for bots
|
|
- Hides login errors (stops username enumeration)
|
|
- Email alerts for admin logins from new IPs
|
|
- Country/IP restrictions on login page
|
|
|
|
### IP Control
|
|
- Whitelist and blacklist
|
|
- Auto-blacklist after repeated lockouts
|
|
- IPv4, IPv6, CIDR supported
|
|
|
|
### Geo Blocking
|
|
- Block countries
|
|
- Uses free IP2Location LITE database
|
|
- One-click download
|
|
|
|
### Hardening
|
|
- Disable XML-RPC
|
|
- Disable dashboard file editing
|
|
- Disable application passwords
|
|
- Restrict REST API to logged-in users
|
|
- Remove WordPress version
|
|
- Block user enumeration (?author=1 and REST API)
|
|
- Disable pingbacks/trackbacks
|
|
|
|
### Security Headers
|
|
X-Content-Type-Options, X-Frame-Options, X-XSS-Protection, Referrer-Policy, Permissions-Policy, Content-Security-Policy, HSTS
|
|
|
|
### Two-Factor Authentication
|
|
- TOTP (Google Authenticator, Authy, etc.)
|
|
- Backup codes
|
|
- Enforce for admins
|
|
|
|
### File Integrity Monitoring
|
|
- Checks WordPress core files against official checksums
|
|
- Daily scans
|
|
- Email alerts on changes
|
|
|
|
### Malware Scanner
|
|
- Scans plugins, themes, uploads
|
|
- Pattern-based detection
|
|
- Weekly scans
|
|
- Does not scan core files (that's what File Integrity is for)
|
|
|
|
### Activity Log
|
|
- Login attempts, lockouts, blocks
|
|
- IP, country, username, timestamp
|
|
- Configurable retention
|
|
- CSV export
|
|
|
|
### Tools
|
|
- Export/import settings
|
|
- Force logout all users
|
|
- Test email
|
|
|
|
## Installation
|
|
|
|
1. Upload to `/wp-content/plugins/wp-security-pack/`
|
|
2. Activate
|
|
3. Configure under Security menu
|
|
|
|
## FAQ
|
|
|
|
**Premium version?**
|
|
No. This is it.
|
|
|
|
**Will it slow my site?**
|
|
No. Checks run on login and admin access, not frontend loads.
|
|
|
|
**Locked myself out?**
|
|
Rename the plugin folder via FTP/SSH. Log in. Fix settings.
|
|
|
|
**Geo-blocking without database?**
|
|
Won't work. Download IP2Location LITE from settings. It's free.
|
|
|
|
**Use with other security plugins?**
|
|
Possible but likely conflicts. Pick one.
|
|
|
|
## Privacy
|
|
|
|
No tracking. No analytics. No telemetry.
|
|
|
|
External connections:
|
|
- WordPress.org API (core file checksums)
|
|
- IP2Location (database download, only when you click it)
|
|
|
|
## License
|
|
|
|
GPLv2 or later
|