Stoutwall – Security Hardening & Login Protection

Description

Stoutwall applies well-known hardening measures that most sites should have, each behind its own switch. There is no firewall, no scanner and no account to create: it changes how WordPress behaves, and you can see and undo every change. One small plugin instead of five single-purpose ones.

What it can do

• Limit login attempts – after 5 failed logins in 15 minutes, the IP address is locked out for 15 minutes. Repeated lockouts last longer, up to 24 hours. Works behind Cloudflare and other proxies, with a list of allowed IP addresses and ranges that are never locked out.
• Security headers – sends X-Content-Type-Options, X-Frame-Options and Referrer-Policy, plus optional HSTS.
• Prevent code execution in uploads – adds rules to wp-content/uploads/.htaccess that block PHP files, including .phtml, .php5, .phar and double extensions such as image.php.jpg. Rules from other plugins in the same file are kept.
• Disable XML-RPC – turns off every XML-RPC method, including pingback.ping, which is often abused for DDoS amplification, and removes the X-Pingback header.
• Prevent user enumeration – stops ?author=N lookups and hides usernames from the REST API for visitors, the users sitemap and oEmbed responses. Authors and editors keep the author list in the block editor.
• Generic login errors – the login form no longer tells attackers whether a username exists. Registration errors are still shown.
• Disable application passwords and require login for the REST API (both off by default).
• Disable file editors – removes the theme and plugin file editors from the dashboard.
• Disable registration – keeps “Anyone can register” off.
• Block the “admin” username for new registrations.
• Hide username as display name – users cannot save a profile whose public display name is their login.
• Hide the WordPress version from the page head and feeds.
• Remove the X-Powered-By header that reveals the PHP version.
• Disable directory browsing in the uploads folder.

Check that it really works

• A Check status button confirms that each protection is in effect on your server, for example that the .htaccess rules are present and the headers reach the browser, not only that the switch is on.
• A read-only security audit looks for weak security keys, copies of wp-config.php, a public debug.log, an “admin” user, open registration with a powerful role and more. It also tests from outside whether PHP files in uploads run and whether folders can be listed. The quick checks also appear in Tools → Site Health.

Rules for your web server

Stoutwall generates matching rules for Apache, LiteSpeed, OpenLiteSpeed and Nginx, so the protections also cover static files and servers that ignore .htaccess. You review and paste them; nothing outside the uploads folder is changed for you.

For developers and agencies

• WP-CLI: wp stoutwall list|status|enable|disable|export|import|lockouts|unlock|allowlist|rules|audit.
• Export the settings to a JSON file and import them on other sites.
• Filters such as stoutwall_security_headers, stoutwall_public_rest_namespaces, stoutwall_login_max_failures and stoutwall_client_ip.

Privacy

Stoutwall does not send anything to external servers, does not add cookies and does not send emails. To limit login attempts it keeps, on your own site, a hashed IP address of failed logins for 15 minutes and a partial IP address (such as 203.0.113.x) of locked-out visitors for up to a day.

Reporting security issues

Please report vulnerabilities privately through the Wordfence or Patchstack programs, which coordinate the fix with the author before disclosure.