ITPS Shield

Description

ITPS Shield locks down a WordPress site in a few clicks. Open Settings → ITPS Shield → Security Audit, press Harden now, and the plugin switches on every protection that is safe for any site. Server (.htaccess) rules are only written when you ask for them, and each one is tested and rolled back automatically if your server rejects it. The plugin never edits or deletes WordPress core files; the audit tells you what to fix by hand.

HTTPS / SSL

• Force HTTPS: every http:// request is redirected to https://, the admin and login use HTTPS, cookies are marked secure and browsers are told to upgrade insecure requests.
• The SSL certificate is tested before Force HTTPS can be switched on, so you can’t lock the site into a broken HTTPS.
• Optional mixed-content fixer and HSTS.

Login protection

• Custom login address: move wp-login.php to an address you choose. /wp-login.php and /wp-admin/ show “Not Found” to logged-out visitors.
• Brute-force lockout per IP, applied after the password check so a correct password can’t bypass it, with email alerts and an unlock screen.
• Login honeypot and real-browser check that stop scripted brute-force tools.
• Generic login errors, strong-password enforcement, optional idle logout and maximum session length.
• Email alerts when any account becomes an Administrator, or an administrator logs in from a new IP.

Spam protection without CAPTCHA

• Comments, WordPress and WooCommerce sign-ups, and contact forms: Contact Form 7, WPForms, Gravity Forms, Elementor Pro Forms, Fluent Forms, Formidable Forms and Ninja Forms.
• Invisible honeypot, real-browser check and minimum fill time. Real visitors see nothing.
• Sign-ups from disposable email addresses are refused; comments with too many links go to spam.
• Disable comments site-wide in one click (comments, pingbacks, admin menus, comment blocks, comment feeds and the comments REST API).

Firewall and attack surface

• Request firewall for SQL injection, XSS, path traversal, stream wrappers, code injection, null bytes and probes for .env, .git and wp-config.php, plus vulnerability-scanner user agents.
• XML-RPC and pingbacks disabled, user enumeration blocked (?author=N, REST /wp/v2/users, oEmbed, user sitemap).
• Optional REST API restriction for logged-out visitors with an allow-list.
• Theme/plugin file editor disabled; optional block on installing or uploading plugins and themes from the dashboard (updates still work).

Hide WordPress

• Removes the generator tag, WordPress links and headers and the emoji script.
• Replaces ?ver= on every core, theme and plugin file with a hash, so versions can’t be read but caches still refresh after updates.
• Hides the plugin list in /wp-json/ and blocks plugin readme and changelog files, logs and backups in wp-content.
• Your own site icon and name on the login page, and no WordPress logo as a fallback favicon.
• Optional “Protected by ITPS Shield” page for blocked visitors (off by default; it includes a credit link).

Server hardening

• Security headers (nosniff, frame protection, referrer and permissions policy).
• No PHP execution in uploads; optional root .htaccess hardening that also blocks readme.html, license.txt and wp-config-sample.php.
• Every .htaccess file is tested with a real request after it is written and removed again if the server answers with an error.
• The audit checks wp-config.php permissions and version-revealing files and explains how to fix them.

Audit and monitoring

• Security Audit with a score, per-check Fix buttons and a one-click Harden now.
• Core file integrity scan against the official checksums from WordPress.org, plus detection of unknown PHP files in wp-admin and wp-includes.
• Activity log, locked-IP list and IP allow-list (IPv4 / IPv6 addresses and IPv4 ranges).

ITPS Shield has no external service, no account and no tracking. The only outside request is the core file scan, which downloads WordPress’s official checksums from api.wordpress.org when you run it.