Login lockout, a lightweight request firewall, a WordPress core integrity scan, hardening switches and a security activity log, all running on your own server.
Read the documentationA small, honest security plugin. Every feature is off until you turn it on, nothing is sent to the plugin author, and the firewall rules were written for this plugin. It is free and open source (GPLv2 or later).
Counts failed logins per IP address and locks the address out after a set number of failures (default 5 in 15 minutes, for 30 minutes). Covers the login form, XML-RPC and application passwords. Unlock from the Dashboard.
Blocks obvious SQL injection, script injection and path traversal probes in the page address, query string and form field names with a 403 page. Optional XML-RPC switch and wp-login.php rate limit.
One click compares every WordPress core file with the official WordPress.org checksums and lists modified, missing and unknown files. Report only: nothing is changed or deleted.
Turn off the file editors, limit username discovery, hide the version tag and turn off application passwords.
Logins, failed logins, lockouts, firewall blocks, scans and setting changes, with time, IP address and username. Newest 500 entries, with filter and clear.
Every feature is off until you turn it on. No tracking, no account, nothing sent to 007AJ. The only outside request is the checksum download when you run a scan.
REMOTE_ADDR (see the documentation if you use a proxy or CDN)Need more? 007AJ Security Scanner & Firewall Suite is a separate, standalone plugin that adds firewall rule categories, IP allow and block lists, more rate limits, scheduled scans, file change monitoring, file repair and live traffic.