Open24 Security
The settings screen. Every option is off by default and can be enabled individually, grouped by area: REST API, login, protocols, information disclosure, HTTP headers and WooCommerce.
Open24 Security applies a set of well-known hardening measures to WordPress and WooCommerce sites from a single settings screen. Every option is off by default and can be switched on individually, so you decide exactly how much you want to restrict.
The plugin does not phone home, does not require an account and does not send any data to external services. The only outbound request it makes is to the official WordPress.org API, and only when you explicitly rotate your security keys.
Features
WordPress REST API
- Hide the /wp-json/wp/v2/users endpoint
- Require authentication on sensitive endpoints
- Disable the /wp-json/ index
Login
- Custom login URL (replace wp-login.php with your own slug)
- Limit login attempts per IP address
- Block common usernames such as admin or root
- Hide error hints that reveal whether a username exists
Protocols
- Disable XML-RPC
- Block external access to wp-cron.php
- Block user enumeration via ?author=N
Information disclosure
- Hide the WordPress version from the generator meta tag and RSS feeds
HTTP security headers
- X-Frame-Options, X-Content-Type-Options, Referrer-Policy
- Permissions-Policy, X-XSS-Protection
- Optional HSTS
WooCommerce
- Reject anonymous requests to the /wc/v3/ and /wc/v2/ REST routes
- Hide WooCommerce headers on the storefront
Tools
- Log out all users: rotates the WordPress security keys and salts, which invalidates every session cookie and immediately signs out all logged-in users. Useful after a suspected compromise or when an employee leaves.
- Change log: records which settings were changed and when.
Agency signature
- Adds an Open24 signature in the document head so the site can be identified as maintained by the agency by crawlers such as BuiltWith. This can be turned off.
About the security keys feature
Rotating the WordPress security keys requires updating the corresponding constants in wp-config.php. The plugin does this through the official WP_Filesystem API, writes to a temporary file with restrictive permissions and then moves it over the original in a single atomic operation, preserving the original file permissions. No backup copy is left anywhere on the server, and if any step fails, wp-config.php is left untouched.
If wp-config.php is not writable, the feature reports it and makes no changes.