by Marc Armengou
0 (0 reviews)
Security Hardener
Basic hardening: secure headers, login honeypot, user enumeration blocking, generic login errors, rate limiting, and more.
Compatible with WP 7.0.2
v2.4.4
Current Version v2.4.4
Updated 1 month ago
Last Update on 14 Jun, 2026
Refreshed 9 hours ago
Last Refreshed on
Rank
#12,661
+82 this week
Active Installs
200+
-11.1%
KW Avg Position
116.7
+0.4 better
Downloads
1.8K
+4 today
Support Resolved
0%
—
No change
Rating
0%
Review 0 out of 5
0
(0 reviews)
Next Milestone 300
200+
300+
1,456
Ranks to Climb
-
Growth Needed
8,000,000
Active Installs
Pro
Unlock Exact Install Count
See the precise estimated active installs for this plugin, calculated from real-time ranking data.
- Exact install estimates within tiers
- Track install growth over time
- Milestone progress predictions
Need 73 more installs to reach 300+
Rank Changes
Current
#12,661
Change
Best
#
Downloads Growth
Downloads
Growth
Peak
Upgrade to Pro
Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.
Upgrade NowReviews & Ratings
0.0
0 reviews
Overall
0%
5
0
(0%)
4
0
(0%)
3
0
(0%)
2
0
(0%)
1
0
(0%)
Tracked Keywords
Showing 3 of 3| Keyword | Position | Change | Type | Updated |
|---|---|---|---|---|
| hardening | 32 | — | Tag | 21 hours ago |
| Brute Force | 128 | — | Tag | 21 hours ago |
| login protection | 190 | — | Tag | 21 hours ago |
Unlock Keyword Analytics
Track keyword rankings, search positions, and discover new ranking opportunities with a Pro subscription.
- Full keyword position tracking
- Historical ranking data
- Competitor keyword analysis
Track This Plugin
Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.
Start Tracking FreePlugin Details
- Version
- 2.4.4
- Last Updated
- Jun 14, 2026
- Requires WP
- 6.9+
- Tested Up To
- 7.0.2
- PHP Version
- 8.2 or higher
- Author
- Marc Armengou
Support & Rating
- Rating
- ☆ ☆ ☆ ☆ ☆ 0
- Reviews
- 0
- Support Threads
- 0
- Resolved
- 0%
Keywords
Upgrade to Pro
Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.
Upgrade NowSimilar Plugins
Adminify – White Label, Admin Menu Editor, Login Customizer
7K+ installs
#2,724
Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits
30K+ installs
#988
LiteSpeed Cache
7M+ installs
#5
Akismet Anti-spam: Spam Protection
5M+ installs
#7
Wordfence Security – Firewall, Malware Scan, and Login Security
5M+ installs
#11
Frequently Asked Questions
Common questions about Security Hardener
By default, the plugin enables: * File editor disabled * XML-RPC disabled * User enumeration blocking * Generic login errors * Login honeypot * Block unsafe usernames * Login rate limiting (5 attempts per 15 minutes) * Security headers * WordPress version hiding (meta generator tag and asset query strings) * Clean wp_head output * Security event logging * Application Passwords disabled HSTS and author feed blocking are disabled by default. Application Passwords are disabled by default — disable this option only if you use the WordPress mobile app, Jetpack, or other REST API integrations that require them.
No. The plugin uses lightweight WordPress hooks and native functions. Security headers add negligible overhead, and rate limiting only checks transients during login attempts.
By default, rate limiting uses REMOTE_ADDR. If behind a trusted proxy, add this to wp-config.php: define('WPSH_TRUSTED_PROXIES', array( '173.245.48.0', // Example: Cloudflare IP range // Add your proxy IPs here )); The plugin will then check HTTP_CF_CONNECTING_IP (Cloudflare) or HTTP_X_FORWARDED_FOR headers.
* X-Frame-Options: SAMEORIGIN * X-Content-Type-Options: nosniff * Referrer-Policy: strict-origin-when-cross-origin * Permissions-Policy: geolocation=(), microphone=(), camera=()
* Strict-Transport-Security: max-age=31536000 (optionally with includeSubDomains if enabled)
Yes. Security headers are sent at the PHP level before caching. However, if you use aggressive server-level caching, you may need to configure your cache to allow these headers through.
Yes, but be careful of conflicts. If another plugin also: * Sends security headers, you may get duplicates (usually harmless) * Blocks user enumeration, one should be disabled * Has login rate limiting, choose one to avoid confusion This plugin is designed to be lightweight and focused on core WordPress hardening.
When you uninstall (not just deactivate) the plugin, data is preserved by default. If you have enabled the "Delete all data on uninstall" option under Settings > Security Hardener > Other Settings, then on uninstall: * All plugin settings are deleted * All security logs are deleted * All login rate limiting transients are cleared * Your WordPress installation is returned to its default state Note: Deactivating the plugin always preserves all settings.
No. The plugin only secures user-related endpoints by requiring authentication. All other REST API functionality works normally. Public endpoints like oEmbed continue to work.
Failed login blocks expire automatically based on your configured window (default: 15 minutes). Wait for the block period to expire, or: Access your database (phpMyAdmin, etc.) Search for options with _transient_wpsh_login_ in the name Delete those transient options Try logging in again