by thessleysecurity 5 (1 reviews)

Thessley Security Hardening

Name: Thessley Security Hardening
Rating: 5.0 (1 reviews)
Author: thessleysecurity

Modular WordPress security hardening — IP/country blocking, request inspection, file integrity, malware scanning, and real-time alerting.

Thessley Security Hardening ranks #62,819 among WordPress.org plugins with 1+ active installations, is #2,854 of 5,058 in the Security category, a 5/5 rating from 1 reviews, and was last updated Sep 27, 2026. Data from WordPress.org, refreshed twice daily — see methodology.

Compatible with WP 7.1

v1.0.21 Current Version v1.0.21

Updated 1 month ago Last Update on 27 Sep, 2026

Refreshed 1 week ago Last Refreshed on

#2,854 of 5,058 in Security

View on WordPress.org

Rank

#62,819

— No change

Active Installs

-50%

KW Avg Position

113.5

0.5 worse

Downloads

308

+1 today

Support Resolved

— No change

Rating

100%

Review 5 out of 5

5 (1 reviews)

Next Milestone 10

Total Progress 20%

0+ 10+

49,882

Ranks to Climb

Growth Needed

8,000,000

Active Installs

Pro

Unlock Exact Install Count

See the precise estimated active installs for this plugin, calculated from real-time ranking data.

Exact install estimates within tiers
Track install growth over time
Milestone progress predictions

Upgrade to Pro

Need 8 more installs to reach 10+

Rank Changes

Current #62,819

Change

Best #

Upgrade to Pro

Unlock 30-day and 90-day rank history charts with a Pro subscription.

Upgrade Now

Active Installs Growth

Upgrade to Pro

Active Installs 0,000,000+

Growth +0.0%

Peak 0,000,000

Downloads Growth

Downloads

Growth

Peak

Upgrade to Pro

Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.

Upgrade Now

Reviews & Ratings

5.0

1 reviews

Overall 100%

1 (100%)

0 (0%)

Track This Plugin

Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.

Start Tracking Free

Plugin Details

Version: 1.0.21
Last Updated: Sep 27, 2026
Requires WP: 6.0+
Tested Up To: 7.1
PHP Version: 7.4 or higher
Author: thessleysecurity

Support & Rating

Rating: ★ ★ ★ ★ ★ 5
Reviews: 1
Support Threads: 0
Resolved: 0%

Keywords

Brute Force firewall geo blocking malware security

Upgrade to Pro

Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.

Upgrade Now

Similar Plugins

Adminify – White Label, Admin Menu Editor, Login Customizer

6K+ installs

#2,757

Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits

Akismet Anti-spam: Spam Protection

5M+ installs

Wordfence Security – Firewall, Malware Scan, and Login Security

5M+ installs

#11

Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)

Limit Login Attempts Security - Login Security, 2FA, Firewall, Brute Force Prevention

View all Security-and-spam-protection plugins

Frequently Asked Questions

Common questions about Thessley Security Hardening

Every blocking module exempts your LAN, reserved/private IP space, and anything in the trusted-networks list, before it ever looks at the rest of its rules. Geo Blocker and Geo Login specifically cannot lock out your own network regardless of which countries you select.

The early-request checks (IP Blocklist, Geo Blocker, Geo Login, Rate Limiter, Query Guard's query-string scan) run as a must-use plugin before WordPress finishes bootstrapping, using compiled binary-search lookups rather than database queries — no per-request network calls, no per-request external API hits.

Two places by default, both created by the plugin itself and both removed when it is deleted (the loader file also when you deactivate it), plus one optional block you can switch on in Hardening: wp-content/mu-plugins/wp-thessley-early.php — a single small must-use plugin. This is what lets the blocking modules run before WordPress and other plugins load, the same reason caching plugins install a drop-in. It contains no site-specific data and is a copy of mu-loader/wp-thessley-early.php inside this plugin. It loads each enabled module's check.php directly from this plugin's folder, so nothing else is copied into wp-content. If mu-plugins isn't writable, the plugin still works, but early blocking is off and an admin notice says so. wp-content/uploads/thessley-security-hardening/ — compiled datasets (the merged IP-blocklist ranges, the geo-country index, the trusted-networks list), located with wp_upload_dir() and protected from direct web access with .htaccess and an index.php. They are plain data files (binary, JSON and text), never PHP, and nothing in this folder is executed. Optional, off by default: the "Web-root protection" setting in Hardening adds one marked block to the site's .htaccess (using WordPress' own insert_with_markers()) that makes Apache refuse files such as wp-config.php.bak, database dumps, error_log, readme.html and stray archives, which the web server would otherwise hand out without PHP ever running. Unchecking the setting, or deactivating the plugin, removes exactly that block. Everything else (settings, the local blocklist, the event log) is stored in the database. The plugin never writes to WordPress core folders, its own plugin folder, or other plugins' or themes' folders.

DB-IP's free Country Lite database (CC BY 4.0), refreshed automatically on a schedule.