WP-Security-Pack/README.md

WP Security Pack

WordPress security without the bullshit. No upsells, no premium tier, no fake threat counters.

Requirements

• WordPress 5.0+
• PHP 7.4+

What It Does

Login Protection

• Blocks IPs after failed login attempts
• Custom login URL (hides wp-login.php)
• Hides wp-admin from logged-out users
• Honeypot field for bots
• Hides login errors (stops username enumeration)
• Email alerts for admin logins from new IPs
• Country/IP restrictions on login page

IP Control

• Whitelist and blacklist
• Auto-blacklist after repeated lockouts
• IPv4, IPv6, CIDR supported

Geo Blocking

• Block countries
• Uses free IP2Location LITE database
• One-click download

Hardening

• Disable XML-RPC
• Disable dashboard file editing
• Disable application passwords
• Restrict REST API to logged-in users
• Remove WordPress version
• Block user enumeration (?author=1 and REST API)
• Disable pingbacks/trackbacks

Security Headers

X-Content-Type-Options, X-Frame-Options, X-XSS-Protection, Referrer-Policy, Permissions-Policy, Content-Security-Policy, HSTS

Two-Factor Authentication

• TOTP (Google Authenticator, Authy, etc.)
• Backup codes
• Enforce for admins

File Integrity Monitoring

• Checks WordPress core files against official checksums
• Daily scans
• Email alerts on changes

Malware Scanner

• Scans plugins, themes, uploads
• Pattern-based detection
• Weekly scans
• Does not scan core files (that's what File Integrity is for)

Activity Log

• Login attempts, lockouts, blocks
• IP, country, username, timestamp
• Configurable retention
• CSV export

Tools

• Export/import settings
• Force logout all users
• Test email

Installation

1. Upload to /wp-content/plugins/wp-security-pack/
2. Activate
3. Configure under Security menu

FAQ

Premium version? No. This is it.

Will it slow my site? No. Checks run on login and admin access, not frontend loads.

Locked myself out? Rename the plugin folder via FTP/SSH. Log in. Fix settings.

Geo-blocking without database? Won't work. Download IP2Location LITE from settings. It's free.

Use with other security plugins? Possible but likely conflicts. Pick one.

Privacy

No tracking. No analytics. No telemetry.

External connections:

• WordPress.org API (core file checksums)
• IP2Location (database download, only when you click it)

License

GPLv2 or later