WT Hardening

WT Hardening is a lightweight, modular security plugin that turns on the most important WordPress hardening measures without modifying your theme, wp-config.php, or .htaccess. Everything works through WordPress hooks and can be disabled at any moment with a single click.

The plugin is completely free, without a PRO version, without ads, and without sending data to external servers. Built by the Webmasters.Team crew for daily WordPress work.

Modules

• XML-RPC: blocks xmlrpc.php (403) and filters the XML-RPC methods. Stops brute-force attacks through the most attacked WordPress endpoint.
• User enumeration: hides logins by blocking /wp/v2/users in the REST API for unauthenticated users.
• Author archive: redirects /?author=1 and author archive URLs to the homepage for visitors who are not logged in, and removes the users sitemap (another enumeration vector).
• Hide oEmbed author: strips author_name and author_url from oEmbed responses (WPScan-detectable user-enumeration vector) and drops the oEmbed discovery <link> tags from <head>.
• Hide WP version: removes the <meta name="generator"> tag and redundant meta tags (wlwmanifest, rsd, shortlink), and replaces the ?ver= values of front-end assets with a short keyed hash: the versions are not revealed, but the value still changes after every update, so browsers and caches load the new files.
• X-Pingback: removes the X-Pingback HTTP header from all responses.
• Login errors: replaces the specific “wrong login / wrong password” messages with a single generic text (does not reveal whether a login exists) on wp-login.php, the WooCommerce login form, REST API application passwords (HTTP Basic auth) and XML-RPC.
• Login limiter: blocks an IP (for IPv6, its /64 network) for X minutes after N failed attempts on wp-login.php, the WooCommerce login form, XML-RPC and REST API application passwords. Repeated lockouts within 24 hours escalate to a long lockout (default: 4th lockout = 24 hours). Shows the number of attempts left, an IP/CIDR allowlist, Cloudflare / reverse-proxy support, one-click unlock in the log and optional email alerts. Data lives in dedicated tables (not wp_options), with hourly cleanup of old entries.
• File editor: sets DISALLOW_FILE_EDIT, hiding the theme and plugin editor in the admin (an attacker who compromises an account cannot inject a backdoor through the browser).
• Password policy: enforces minimum length and complexity (upper and lower case, digits, optionally symbols) for profile updates, registration, password reset and the REST API users endpoints.
• Security HTTP headers: X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, optionally HSTS (use with care because browsers cache it for a year) with a separate opt-in for includeSubDomains. HSTS is also sent when HTTPS ends at Cloudflare or at a trusted reverse proxy (X-Forwarded-Proto).
• Event log: records logins (successful and failed), registrations, user changes, plugin activations and deactivations, theme switches, and settings updates. Retention defaults to 30 days. Visible in the admin panel.

What makes it different

• Modular architecture: each module is a separate class and can be disabled in the settings without affecting the others.
• Zero external dependencies: no Composer, no vendor lock-in, no cloud APIs.
• No data leaves the instance: everything stays in the local MySQL/MariaDB database. The only outgoing request is a weekly download of Cloudflare’s public IP range lists (see External services), which sends nothing about your site or visitors.
• Internationalization ready: full coverage with __()/esc_html__(), a POT file for translators and a bundled Polish translation.
• Clean uninstall: when the plugin is removed, options, tables, and cron jobs are dropped.

What WT Hardening does NOT do (by design)

• Does not scan for malware. That is a different problem and a different toolset.
• Does not ship telemetry to the cloud. All data is local.
• Does not add a WAF at the application layer. That belongs to the server or CDN.

For those needs we recommend dedicated plugins (e.g. Wordfence) or an infrastructure layer (Cloudflare, fail2ban).

External services

This plugin connects to one external service: Cloudflare’s published IP range lists. It needs them to recognise requests that come through Cloudflare, so that the login limiter and the event log use the visitor address from the CF-Connecting-IP header only for genuine Cloudflare traffic (and HSTS is sent when HTTPS ends at Cloudflare).

• What is requested: two plain-text files, https://www.cloudflare.com/ips-v4 and https://www.cloudflare.com/ips-v6.
• When: once a week, by a WP-Cron event (wt_hardening_cloudflare_ranges), and not on visitor requests.
• What is sent: nothing beyond a normal HTTP GET request from your server (its IP address and a WT-Hardening/<version> user agent). No cookies, no site address, no visitor or user data.
• The downloaded lists are used only if every line is a valid IP range; otherwise the previous list (or the copy bundled with the plugin) is kept. Developers can turn the update off with the wt_hardening_update_cloudflare_ranges filter (return false); the bundled list is then used.
• The service is provided by Cloudflare, Inc.: Website Terms of Use, Privacy Policy.