Security Hardener
Basic hardening: secure headers, login honeypot, user enumeration blocking, generic login errors, rate limiting, and more.
00
·100 active installs·Updated 2 days agoAs of April 2026, Security Hardener is a WordPress headers plugin with 100 active installations and a 0/5 rating0. It has been downloaded 891 times in total. Requires WordPress 6.9+ and PHP 8.2+. Available on WordPress.org since 2025. Actively maintained — updated within the last month. Top alternative: Headers Security Advanced & HSTS WP.
0/5Rating
100active installs
891total downloads
1 yearsince 2025
Overview
Security Hardener applies WordPress security best practices based on the WordPress Advanced Administration / Security / Hardening documentation and widely accepted hardening measures. It uses WordPress core functions and follows best practices without modifying core files.
Key Features
File Security:
* Disable file editor in WordPress admin
* Optionally disable all file modifications (blocks updates – use with caution)
XML-RPC Protection:
* Disable XML-RPC completely (enabled by default)
* Remove pingback methods when XML-RPC is enabled
Pingback Protection:
* Disable self-pingbacks
* Remove X-Pingback header
* Block incoming pingbacks
User Enumeration Protection:
* Block /?author=N queries (returns 404)
* Secure REST API user endpoints (require authentication)
* Remove users from XM…
Ratings & Reviews
00 reviews
5 ★
0
4 ★
0
3 ★
0
2 ★
0
1 ★
0
Compatibility
| WordPress | 6.9+ requiredTested up to 6.9.4 |
| PHP | 8.2+ required |
Top Alternatives to Security Hardener
Frequently Asked Questions
Changelog
2.2.0 – 2026-04-01
- Added: Login honeypot — a hidden field added to the login form that silently blocks bots before any credential check.
- Added: Block author feeds — optionally blocks /author/username/feed/ pages that can confirm existing usernames.
- Added: Disable Application Passwords — disables REST API authentication via Application Passwords; enabled by default.
- Added: System Status section — replaces the separate File Permissions section; shows file permissions and WP_DEBUG status in a unified table, always visible with with color-coded indicators.
- Added: Two new items to the hardening checklist — disable display_errors in PHP configuration, and disable WP_DEBUG_DISPLAY on live sites.
Contributors
Plugin data sourced from WordPress.org. Analysis and metrics by PluginSift.