{"id":10841,"date":"2026-05-21T10:30:28","date_gmt":"2026-05-21T02:30:28","guid":{"rendered":"https:\/\/aeosub.com\/jr-security-hardening-login-protection\/"},"modified":"2026-05-21T10:30:28","modified_gmt":"2026-05-21T02:30:28","slug":"jr-security-hardening-login-protection","status":"publish","type":"post","link":"https:\/\/aeosub.com\/zh\/jr-security-hardening-login-protection\/","title":{"rendered":"JR Security Hardening and Login Protection"},"content":{"rendered":"
\n\n\n\n\n\n\n\n
Developer<\/th>\nreinajhon46<\/a><\/td>\n<\/tr>\n
Version<\/th>\nv1.0.0<\/td>\n<\/tr>\n
Active Installs<\/th>\n0 +<\/td>\n<\/tr>\n
Requires \/ Tested<\/th>\n5.0 \/ 6.9.4<\/td>\n<\/tr>\n
Last Updated<\/th>\n2026-05-21 2:15am GMT<\/td>\n<\/tr>\n
Official Link<\/th>\nView Details \u2192<\/a><\/td>\n<\/tr>\n<\/table><\/div>\n
WordPress hardening and login protection: security headers, enumeration blocking, rate limiting, IP whitelist, event logging and server rules.<\/div>\n

JR Security Hardening and Login Protection secures your WordPress installation at the application level with one-click hardening modules. Designed to be secure by default and Cloudflare compatible.<\/p>\n

Included modules:<\/strong><\/p>\n

    \n
  • Disable XML-RPC<\/strong> \u2014 Full block (filter + hard block) to prevent brute force attacks and pingback DDoS.<\/li>\n
  • Hide WordPress version<\/strong> \u2014 Removes version from generator meta and CSS\/JS assets.<\/li>\n
  • Disable file editor<\/strong> \u2014 Prevents theme and plugin editing from the admin panel (DISALLOW_FILE_EDIT).<\/li>\n
  • Disable emojis<\/strong> \u2014 Removes WordPress emoji scripts and styles, improving performance.<\/li>\n
  • Block user enumeration (?author= and \/author\/)<\/strong> \u2014 Dual-layer protection against username discovery.<\/li>\n
  • Block REST enumeration (wp-json users)<\/strong> \u2014 Prevents enumeration via the WordPress REST API.<\/li>\n
  • Block sensitive paths\/files<\/strong> \u2014 Blocks access to readme.html, license.txt, .env, .git, composer.json, etc. (only what passes through WordPress).<\/li>\n
  • Security headers<\/strong> \u2014 X-Content-Type-Options, Referrer-Policy, Permissions-Policy, X-Frame-Options, HSTS (HTTPS only) and removal of technology-revealing headers.<\/li>\n
  • Login protection<\/strong> \u2014 Rate limiting by IP and by user+IP with configurable temporary lockout.<\/li>\n
  • IP whitelist<\/strong> \u2014 Excludes trusted IPs from rate limiting to avoid accidental lockouts.<\/li>\n
  • Email notification<\/strong> \u2014 Receive an email when an IP is locked out due to too many failed login attempts.<\/li>\n
  • Activity log<\/strong> \u2014 Security event logging in a dedicated database table with configurable retention and automatic cleanup via cron.<\/li>\n
  • Ready-to-use server rules<\/strong> \u2014 Code for Apache (.htaccess) and Nginx to block static files that WordPress cannot reach.<\/li>\n<\/ul>\n

    Smart IP detection:<\/strong><\/p>\n

      \n
    • Native support for Cloudflare (CF-Connecting-IP).<\/li>\n
    • Option to trust X-Forwarded-For \/ X-Real-IP behind trusted proxies.<\/li>\n
    • Fallback to REMOTE_ADDR.<\/li>\n<\/ul>\n

      Clean uninstall:<\/strong><\/p>\n

      When the plugin is deleted, all options, the events table and transients are removed. No data is left behind in your database.<\/p>","protected":false},"excerpt":{"rendered":"

      WordPress hardening and login protection: security headers, enumeration blocking, rate limiting, IP whitelist, event logging and server rules.<\/p>","protected":false},"author":1,"featured_media":9317,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[252],"tags":[1027,1449,664,555],"class_list":["post-10841","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-trends","tag-hardening","tag-login-protection","tag-security","tag-wordpress-plugin"],"_links":{"self":[{"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/posts\/10841","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/comments?post=10841"}],"version-history":[{"count":0,"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/posts\/10841\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/media\/9317"}],"wp:attachment":[{"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/media?parent=10841"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/categories?post=10841"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/tags?post=10841"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}