DoctorX Hardening makes your WordPress site harder to break into. It closes a few doors that WordPress leaves open, lets people add a code from their phone when they sign in, and can keep a record of who did what on your site.

You do not need to know anything about security to use it. Turn it on and the main protections work right away. Everything is free. Nothing is locked and there is no paid version.

What it does as soon as you turn it on

Hides your usernames. Normally anyone can look up the usernames on a WordPress site. A username is half of what someone needs to break in. Visitors can no longer see them.
Hides your list of plugins. Normally WordPress tells anyone who asks which plugins your site runs. Attackers use that list to look for a weak one. Visitors no longer get it.
Keeps author pages from giving names away. Links to author pages now go to your home page. If your site shows author pages on purpose, switch this one off.
Stops a small WordPress guess. When someone types a short address like /fr/ that does not exist, they get “page not found” instead of being sent to a page with a similar name.
Offers two-step sign-in. Each person can choose to type a 6-digit code from a free phone app after their password. Then a stolen password alone is not enough to get in. Nobody has to use it unless you make it required.

Each one has its own on/off switch under Settings Hardening.

Extra protections you can switch on

These are all off until you switch them on. Each one says how to undo it.

Lock out password guessers. An internet address that gets the password wrong 5 times in a day cannot sign in for 30 days. You choose addresses that are never locked out, such as your office.
Require two-step sign-in for the roles you choose, such as administrators, from a date you pick.
Email a code to someone who does not have their phone with them.
Close little-used doors: XML-RPC (an old way for apps to sign in), app passwords, and the WordPress version number shown in your pages.
Hide your sign-in page at an address only you know. Not for shops or member sites, where visitors sign in themselves.
Block scanners. A visitor who asks for secret files that only hacking tools look for is blocked from the whole site for 7 days. Search engines are never blocked.
Activity record. See who signed in, who failed to, and who changed posts, pages, plugins, settings or users, and when. Get an email, Slack, Teams, Discord or Telegram alert when something important happens.
security.txt. A small standard file that tells someone who finds a security problem on your site how to reach you.
Cloudflare rules, if your site uses Cloudflare. Add ready made blocking rules with one button and take them away with another.
Ready made lines for your web server, for you or your web host to copy in.

What it does not do

So you know where its job ends:

It is not a virus or malware scanner. It does not clean a site that has already been hacked.
It does not check every visit for attacks the way a firewall service does.
It does not make backups.
It does not update or fix your other plugins and themes. Keep them up to date.
It does not change what visitors, search engines or AI assistants see on your pages. Your search ranking is not affected.
Hiding things makes an attack harder, not impossible. Strong passwords and updates still matter.
It sends nothing about your site or your visitors to DoctorX or anyone else. The outside services listed further down (such as Cloudflare or Slack) are only used if you set them up yourself.

Who it is for

Any WordPress site owner who wants the common holes closed without learning security. It works with any theme and needs no other plugin.

Made by DoctorX.ca.

External services

Nothing in this plugin talks to an outside service until you ask it to. None of the outside services below is used on a website set up not to send (DOCTORX_HARDENING_MAY_CONNECT set to false, or the doctorx_hardening_may_connect filter), such as a staging copy, except WordPress.org’s checksums, which WordPress itself also fetches.

Cloudflare API (https://api.cloudflare.com/client/v4), only after you save a Cloudflare API token of your own on Settings Hardening Sign-in and server, and only for what you press there or switch on. That is:
- listing the zones the token can see
- reading a zone’s custom firewall and rate-limit rules (Preview)
- reading the zone’s cache rules, once a day, for the self-check (read only)
- adding, changing or putting back rules (Apply, Undo, Copy)
- sending the probe ban’s addresses as IP access rules (Send them now)
- with “When a page changes, have Cloudflare forget it” (or DoctorX Command Center’s “Empty caches”), the addresses of changed pages or a “forget everything” request.
Sent: the token (as the request’s authorisation), the zone’s id, the rules this plugin generates (your host names, your trusted addresses, the hidden door’s address when it is on), banned internet addresses, and page addresses. Nothing about your visitors or accounts is sent. Cloudflare’s terms: https://www.cloudflare.com/website-terms/ and privacy policy: https://www.cloudflare.com/privacypolicy/
ipinfo.io (https://ipinfo.io), only when you choose “ipinfo.io” under “Where addresses are” on the activity record’s More settings screen, save your own token, and an administrator opens an address in the record: that one internet address and your token. ipinfo’s terms: https://ipinfo.io/terms-of-service and privacy policy: https://ipinfo.io/privacy-policy
Google Maps Static API (https://maps.googleapis.com), only when you switch on the sign-in map and save your own Google Maps key, and only when an administrator opens the map. Sent: up to 60 rounded map points (latitude and longitude to three decimals, about 100 metres) and your key. No addresses, names or accounts are sent. Google’s terms: https://cloud.google.com/maps-platform/terms and privacy policy: https://policies.google.com/privacy
Alerts, only to the destinations you add on the activity record’s More settings screen (Alerts) and only for the rules you set. Sent: the alert’s subject, text and a link to the record. For a webhook, also your site’s address, the rule’s name and the event (as below). The destinations can be:
- Slack (the webhook address you paste). Terms https://slack.com/main-services-agreement and privacy https://slack.com/trust/privacy/privacy-policy
- Discord. Terms https://discord.com/terms and privacy https://discord.com/privacy
- Microsoft Teams. Terms https://www.microsoft.com/en-us/servicesagreement and privacy https://www.microsoft.com/en-us/privacy/privacystatement
- Telegram (api.telegram.org with your bot’s token and chat). Terms https://telegram.org/tos and privacy https://telegram.org/privacy
- any address of your own that takes JSON, signed with your secret if you set one.
Log forwarding, only when you switch it on on the activity record’s More settings screen and switch on a destination with its connection details. Sent: every event as it is written, with its date, kind, level, message, who did it (user id, login and email address), the internet address and any addresses passed on by a proxy, the browser’s user agent, what it was about, the event’s details and your site’s address. (Writing to this server’s own system log is not an outside service and also happens on a website set up not to send.) The destinations can be:
- this server’s own system log
- a syslog server you name (UDP, TCP or TLS)
- Datadog’s Logs API with your key. Terms https://www.datadoghq.com/legal/terms/ and privacy https://www.datadoghq.com/legal/privacy/
- Splunk’s HTTP Event Collector with your token. Terms https://www.splunk.com/en_us/legal/splunk-general-terms.html and privacy (Splunk is part of Cisco) https://www.cisco.com/site/us/en/about/legal/privacy.html
- any webhook address of yours.
WordPress.org (https://api.wordpress.org), only when you switch on “Check WordPress’s own files once a day” in the activity record’s settings: once a day, your WordPress version and language, to fetch the official checksums of WordPress’s files (the same request WordPress makes for its own updates). WordPress.org’s privacy policy: https://wordpress.org/about/privacy/
Your server’s DNS resolver, only when you switch on “Also ask for the address’s host name” and an administrator opens an address in the record: that one internet address, to look up its host name (reverse DNS).
The emails this plugin sends (sign-in codes, the hidden door’s address, notes about two-step sign-in) go through your site’s own mail setup to your own people.
Your own site’s address, once a day, for the self-check: a few requests to your own site (a probe file in each private folder and a private probe page), which pass through your proxy or CDN if you have one. Nothing is sent to anybody else.
The crawler-list script on the “Lines for your web server” screen is a file you download and run on your server yourself: it fetches the address lists Google, Bing and Cloudflare publish (developers.google.com, www.bing.com, www.cloudflare.com). The plugin itself does not fetch them.

Source code and credits

All code is included unminified. The picture you scan when setting up two-step sign-in is drawn in the browser by QR Code Generator for JavaScript by Kazuhiko Arase (MIT licence), included unchanged in assets/vendor/qrcode-generator.js. The word “QR Code” is a registered trademark of DENSO WAVE INCORPORATED.