INI Protector is a focused, no-bloat hardening plugin for WordPress. Every feature
is an independent toggle, grouped into three areas:

Security

File integrity monitoring — hashes every code file (.php, .php5, .phtml,
.phar, .js, .htaccess, .user.ini …), keeps a baseline, and re-checks on a
schedule. Any file that is added, changed, or deleted is emailed to you (and
optionally POSTed to a webhook) before the baseline is updated, so the
evidence has already left the server even if the site itself is compromised.
Media is never hashed, but uploads, caches and backup folders are still checked
for executable files — a .php among your images has no innocent explanation and
is reported as critical. Runs from WP-Cron or from system cron via
wp secwp integrity scan.
Two-factor authentication (TOTP) — a time-based one-time code from any
standard authenticator app, required per role. The password is verified first,
then the code, before any session cookie is issued. Recovery codes are issued
at setup, and wp secwp 2fa reset <user> restores access from the shell.
Disable XML-RPC, disable the theme/plugin file editor, require login for the
REST API.
Limit login attempts (IP lockout), mask the login URL to a secret slug.
Password-protect the whole front-end.
Disable comments and pingbacks/trackbacks.
Prevent user enumeration and information disclosure (directory listing,
wp-config/.htaccess/backup/log access; Apache .htaccess rules or an Nginx
snippet).
Hardening HTTP security headers (X-Frame-Options, X-Content-Type-Options,
Referrer-Policy, Permissions-Policy).
ALTCHA proof-of-work login captcha (self-hosted, no third-party calls).
Traffic monitor — records incoming requests so suspicious activity is visible,
with a per-IP drill-down. Keeps the full history by default; you can cap it by
age, by number of requests, or both.
Auto-block escalation — a dedicated IP Block page that surfaces the
traffic monitor’s suggested blocks for one-click review (Block Suggestion
System), and an optional Auto-Block mode that blocks offending IPs
automatically on an escalating temporary schedule (1h 4h 8h 5 days
2 weeks). Never issues a permanent block automatically; an allowlist and
verified search-engine bots are always exempt; quiet IPs decay back down.
Vulnerability scan — a daily check of your installed plugins, themes, and
WordPress core against the free WPVulnerability database (CC0, no API key).
Findings appear on a dedicated page and on the dashboard, with an optional
email alert on new findings. No data about your site is sent — only the
public slug of each component is looked up.

Head cleanup

Remove the generator/RSD/WLW/shortlink tags, strip or mask asset version
query strings, drop front-end Dashicons.

Utilities

Rotate asset cache token — changes the version token on every CSS and JS
URL at once, so returning visitors re-fetch them. Use it after a deploy when
a file has changed but the version it declares has not. Available from
INI Protector Utilities and from wp secwp asset-salt rotate, which is
where it belongs in a deploy script.

SEO & privacy

Disable feeds, disable author archives, obfuscate author slugs, and protect
email addresses from harvesting.

INI WP platform

Exposes a read-only, HMAC-signed REST endpoint (secwp/v1/state) so the
INI WP control panel can pull this site’s security posture and scan results.
The endpoint only activates when the INI WP connector is installed and
configured; auth reuses the connector’s signed channel.

Notes

Head cleanup lives here, not in SeoWP — SeoWP keeps pure SEO concerns
(titles, meta, schema, noindex directives).
Behind a reverse proxy or CDN, tell INI Protector which addresses your proxy
uses so it can read the real visitor IP safely:

define( ‘SECWP_TRUSTED_PROXIES’, ‘173.245.48.0/20, 2400:cb00::/32’ );

Forwarded headers (X-Forwarded-For, CF-Connecting-IP) are then read only when
the connection actually comes from one of those addresses — so a visitor who
reaches your origin directly cannot claim to be someone else, evade an IP
block, or get an innocent IP blocked. Without this, client IPs come from the
socket peer, which cannot be forged. Security Scan reports which mode you
are in. The older SECWP_TRUST_PROXY constant still works but cannot check who
sent the header; replace it when you can.

External services

The optional vulnerability scanner contacts WPVulnerability (https://www.wpvulnerability.com/)
only when you enable Vulnerability Scan. It sends installed plugin/theme slugs
and the WordPress core version to https://www.wpvulnerability.net/ to retrieve
known vulnerabilities. The service also receives the server IP address as part
of the connection. No site URL is included in the plugin’s user agent.
Service and privacy information: https://www.wpvulnerability.com/privacy/

File integrity webhooks are optional. When you configure a webhook URL and enable
alerts, reports containing the site URL, changed file paths, hashes and scan
metadata are sent to that URL. Configure only a recipient you trust; its terms
and privacy policy apply. Email alerts use your site’s configured mail service.

The optional INI WP connector allows your configured control panel to retrieve
security settings and scan results through an authenticated REST endpoint.
INI Protector does not initiate control-panel requests. Service information:
https://iniwp.com

Source code

The bundled ALTCHA widget is version 2.3.0, licensed under MIT.
Source: https://github.com/altcha-org/altcha/tree/v2.3.0
Build instructions are in that project’s README and package.json.
The widget runs locally in the browser; no ALTCHA service account is required.