Title: ELADIVINE Core Author: Elad Yanai Published: November 2, 2026 Last modified: November 2, 2026 --- Search plugins ![](https://ps.w.org/eladivine-core/assets/banner-772x250.png?rev=3780139) ![](https://ps.w.org/eladivine-core/assets/icon-256x256.png?rev=3780126) # ELADIVINE Core By [Elad Yanai](https://profiles.wordpress.org/eladyanai/) [Download](https://downloads.wordpress.org/plugin/eladivine-core.1.11.4.zip) * [Details](https://wordpress.org/plugins/eladivine-core/#description) * [Reviews](https://wordpress.org/plugins/eladivine-core/#reviews) * [Installation](https://wordpress.org/plugins/eladivine-core/#installation) * [Development](https://wordpress.org/plugins/eladivine-core/#developers) [Support](https://wordpress.org/support/plugin/eladivine-core/) ## Description ELADIVINE Core hardens a WordPress site in one plugin: security headers, login protection, REST API and XML-RPC limits, user enumeration blocking and safer uploads. It switches on with sensible defaults, and every part has its own switch on one settings screen. It never doubles up. Before it registers a protection, ELADIVINE Core checks whether another active plugin already provides it, and if so it leaves that job to the other plugin. Two login lockouts or two login URL renames on one site are worse than one: you get locked out at thresholds nobody can explain. #### What it does * **Security headers:** HSTS, X-Frame-Options, Referrer-Policy and a report-only Content Security Policy. * **Login protection:** rate limiting with a lockout after a set number of failed attempts, a honeypot field, blocked usernames, optional immediate lockout on unknown usernames, and an e-mail to the site administrator when a real account is locked. * **Custom login URL:** move the login page to an address of your choice. * **REST API and XML-RPC:** an allowlist for guests, XML-RPC switched off, the users endpoints hidden, oEmbed optional. * **User enumeration:** author scans and `?author=` lookups blocked. * **Uploads:** JPEG quality, SVG uploads with a content check, and safe file names. * **Managed .htaccess rules** on Apache, written in one marked block and checked by loading the site right after. * **Smaller things:** the file editor switched off, generator tags hidden, fake search-engine bots blocked (verified by reverse DNS), image hotlinking blocked, attachment pages and author archives redirected, Heartbeat throttled. * **Site Health:** tests that tell you which protections are off and which plugins overlap. Everything above runs without a licence, an account or a connection to any server of ours. #### Pro add-on A separate Pro plugin is sold on its own. It adds an AI agent toolkit with an MCP server, answer-engine visibility (llms.txt and AI crawler policy), a capability scan, site-specific code, branding and WooCommerce tuning. ELADIVINE Core does not need it and contains none of its code. ## Screenshots [⌊The overview: what is waiting for a decision, and how the site stands.⌉⌊The overview: what is waiting for a decision, and how the site stands.⌉[ The overview: what is waiting for a decision, and how the site stands. [⌊Settings: every protection has its own switch, on one screen.⌉⌊Settings: every protection has its own switch, on one screen.⌉[ Settings: every protection has its own switch, on one screen. [⌊The built-in guide explains who owns which job, and how to get back in if you are locked out.⌉⌊The built-in guide explains who owns which job, and how to get back in if you are locked out.⌉[ The built-in guide explains who owns which job, and how to get back in if you are locked out. ## Installation 1. Install ELADIVINE Core from Plugins > Add New, or upload the zip. 2. Activate it. The protections switch on at once. 3. Review them under Settings > ELADIVINE Core. A setting defined as a constant in wp-config.php wins over the screen and is shown as locked. ## FAQ ### I already use another security plugin. Will they conflict? ELADIVINE Core checks which jobs your other plugins actually perform and stands down on those. A plugin counts as the provider of a job only when that feature is switched on in it. ### I locked myself out with the custom login URL. Add `define( 'WEBACE_SEC_LOGIN_URL', false );` to wp-config.php. The setting is then locked off and the normal login page returns. ### Does it contact any external service? No. ELADIVINE Core sends nothing to any server of ours or anyone else’s. It makes two kinds of lookup: after writing .htaccess rules it loads your own home page to confirm the site still answers, and when a visitor claims to be Googlebot or Bingbot it checks that claim with a reverse DNS lookup. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “ELADIVINE Core” is open source software. The following people have contributed to this plugin. Contributors * [ Elad Yanai ](https://profiles.wordpress.org/eladyanai/) [Translate “ELADIVINE Core” into your language.](https://translate.wordpress.org/projects/wp-plugins/eladivine-core) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/eladivine-core/), check out the [SVN repository](https://plugins.svn.wordpress.org/eladivine-core/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/eladivine-core/) by [RSS](https://plugins.trac.wordpress.org/log/eladivine-core/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.11.4 * The overview no longer lists AI, answer-engine and OAuth features as something this plugin can provide. They belong to the separate Pro plugin. * New plugin mark in the admin screens and the menu. * Overview items no longer show a button that leads back to the same screen. #### 1.11.3 * Password reset links work when the custom login URL is on. The reset link used to redirect to an address of dashes and answer 404. #### 1.11.2 * Renamed to ELADIVINE Core, with the text domain eladivine-core. Constants, functions and the settings option keep their `WEBACE_` / `webace_` prefix, so existing settings and wp-config.php constants keep working. #### 1.11.1 * Login rate limiting trusts CF-Connecting-IP only from Cloudflare’s own ranges and X-Forwarded-For only from a proxy on the server, so a spoofed header can no longer dodge the lockout. * Upload filename cleanup runs on media uploads only, not on every call to sanitize_file_name. * The admin menu sits after the core items. * Translations come from translate.wordpress.org; the plugin no longer bundles or loads its own. * The child-theme notice shows on the Plugins screen and the plugin’s own screens only. #### 1.11.0 * ELADIVINE Core is the hardening alone, free and open. The AI, MCP and GEO pillars, the scan, site-specific code, branding and WooCommerce tuning moved to the separate Pro plugin. * No built-in site operator: with nobody named in `WEBACE_OWNER_EMAILS`, every administrator sees every setting. * English source strings, ready for translation. * Constants, functions and the settings option are prefixed `WEBACE_` / `webace_`. A `DS_` constant in wp-config.php still works, and saved settings carry over on the first load. ## Meta * Version **1.11.4** * Last updated **3 hours ago** * Active installations **Fewer than 10** * WordPress version ** 6.9 or higher ** * Tested up to **7.1.4** * PHP version ** 8.0 or higher ** * Tags * [hardening](https://wordpress.org/plugins/tags/hardening/)[headers](https://wordpress.org/plugins/tags/headers/) [login](https://wordpress.org/plugins/tags/login/)[rest-api](https://wordpress.org/plugins/tags/rest-api/) [security](https://wordpress.org/plugins/tags/security/) * [Advanced View](https://wordpress.org/plugins/eladivine-core/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/eladivine-core/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/eladivine-core/reviews/) ## Contributors * [ Elad Yanai ](https://profiles.wordpress.org/eladyanai/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/eladivine-core/)