Description
H3SEC Guard is built for site owners who want practical security controls without enabling a heavy, opaque security suite.
Project contact: h3st4k3r@h3sec.com
Main capabilities:
- Hardening controls (XML-RPC, file editor, author enumeration, security headers)
- Login protection (attempt limit + temporary IP lockout + optional admin whitelist)
- Activity logging for critical site changes
- Core integrity scan using official WordPress checksums
- Lightweight suspicious PHP scanner with context-aware severity
- Finding-level hashes (MD5/SHA256), full path visibility, and recommendations
- Risk panel (low / medium / high / critical score)
- On-screen findings tables (not only downloads) for suspicious files, core mismatches, and permissions
- Response mode actions (close sessions, force password reset, maintenance, forensic export)
- Default blocking for known malicious probe paths with temporary IP lockout
- Conservative trusted-proxy and IPv4/IPv6 CIDR resolution, including optional Cloudflare forwarding
- Monitor, balanced, and strict public POST inspection with route exclusions and bounded body size
- Read-only server configuration inspection, with explicit atomic creation only for missing Apache/LiteSpeed files
- Safe robots.txt inspection and explicit creation without modifying existing files
- Quick/deep scan modes, bounded findings, exclusions, symlink avoidance, and checksum-unavailable reporting
- Weekly mitigation report with detailed activity counters
- Tracking for attempts with non-existent usernames
- Paginated activity log with expandable event context
- Configurable log retention with automatic daily cleanup
- Local security assistant with explainable next-step guidance
- Branded HTML weekly reports and security alerts
- No hidden telemetry or mandatory third-party APIs
H3SEC Guard is designed as an explainable security plugin. Each control explains:
- what it does,
- what risk it reduces,
- what it may break,
- how to revert it.
Screenshots
Installation
- In wp-admin, open Plugins > Add New > Upload Plugin.
- Upload the H3SEC Guard ZIP and activate it.
- Open
H3SEC Guardin wp-admin. - Review the explainable controls, save settings, and run a Quick or Deep scan.
FAQ
-
No. The plugin has no mandatory external service or telemetry. Official checksum data is requested only when you explicitly run a core integrity scan, and the behavior is documented in the panel.
-
Can this replace a WAF/CDN or server hardening?
-
No. It complements server-level security controls.
-
Will XML-RPC blocking break integrations?
-
It can affect legacy apps, Jetpack setups, or integrations that rely on XML-RPC.
-
Does this plugin send site data externally by default?
-
No. The plugin does not exfiltrate site data, users, emails, or logs by default.
-
What data is stored?
-
The local activity log can contain IP addresses, event types, attempted usernames, request paths, and security event context. It never stores passwords, tokens, cookies, authorization headers, or form bodies. Retention is configurable and old rows are removed in bounded batches. Email notifications are optional. The branded email logo is loaded by the recipient’s email client from
https://h3sec.com/assets/img/logo-h3sec.png. The plugin does not download or store it. -
How can I recover from maintenance mode?
-
The login, reset-password, cron, CLI, AJAX, authenticated H3SEC REST, and administrator paths remain available. For emergency recovery, define
H3SG_BYPASS_MAINTENANCEastruebefore the plugin loads, for example inwp-config.php, then disable maintenance from the panel.
Reviews
There are no reviews for this plugin.
Contributors & Developers
“H3SEC Guard – Security Hardening” is open source software. The following people have contributed to this plugin.
Contributors
Translate “H3SEC Guard – Security Hardening” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
1.2.0
- Promoted the current stable feature set to the 1.2.0 release line.
- Includes the hardened dashboard bootstrap and read-only server detection introduced in the 1.1.x maintenance releases.
1.1.7
- Fixed the admin dashboard fatal error caused by missing web server detection.
- Added conservative Apache, LiteSpeed, Nginx, IIS, and unknown server detection for read-only configuration guidance.
1.1.6
- Fixed dashboard loading when the activity table returns no rows or a database read fails.
- Added a direct Settings link to the plugin action row.
- Hardened first-run scheduling and activation compatibility.
1.1.5
- Added a local update status panel that uses WordPress.org’s normal update cache without a custom ping or forced update.
1.1.4
- Added safe robots.txt and server configuration inspection with explicit atomic creation.
- Added maintenance recovery paths, trusted proxy/CIDR IP resolution, and optional Cloudflare forwarding.
- Added monitor/balanced/strict POST inspection with exclusions and fingerprint-only logging.
- Added bounded event deduplication, repeat counts, weekly rollover, retention batches, and category-based alerts.
- Added shared branded HTML email template, marked test email, and privacy-focused data handling.
- Added Quick/Deep scanner coverage, safe exclusions, symlink avoidance, and checksum availability distinction.
- Separated configuration posture risk from threat activity and sorted assistant recommendations deterministically.
1.1.3
- Added paginated activity events with total counts and expandable context.
- Added configurable log retention and automatic daily cleanup.
- Added a local explainable security assistant to prioritise improvements.
- Improved weekly and alert emails with H3SEC HTML branding and readable tables.
- Removed development-only test files from the published plugin package.
1.1.2
- Updated tested WordPress version compatibility header.
1.1.1
- Improved path resolution for core, admin, includes, content, plugins and uploads directories to better support custom WordPress installations.
1.1.0
- Added weekly mitigation report panel and scheduled weekly email summary.
- Added counters for vulnerable PHP probe tests, forbidden URL requests, form denials, XML-RPC denials, REST API denials, and blocked IPs.
- Added tracking for attempts with non-existent usernames.
- Added optional restrictions for sensitive REST API endpoints and suspicious public POST payloads.
1.0.0
- Initial release.
- Hardening controls and explainable settings.
- Login protection and response actions.
- Activity log with CSV/JSON export.
- Core integrity + suspicious pattern scanner.
- Risk panel and forensic JSON package export.
- Added finding-level hashes, in-dashboard scan result tables, and suggested improvement plan.
- Added known probe-path blocking and temporary lockout for repeated suspicious requests.