Janric Shield

Description

Most WordPress security plugins protect sites by modelling attackers — maintaining lists of known bad IPs, known attack signatures, and known malicious patterns. Janric Shield takes the opposite approach.

Janric Shield models your legitimate users, not the attackers.

During a short learning phase it builds a behavioural profile of how your admins actually log in — when, where, from which networks, and how they interact with the login form. Once that profile is established, anything that deviates significantly from it is flagged as suspicious. A brand new attack tool, a previously unseen technique, a credential stuffing campaign — it doesn’t matter whether it appears on any blocklist. If it doesn’t look like you, it scores high.

How It Works

Learning Phase (Days 1–14)

The plugin silently observes every login attempt and builds a per-site, per-user baseline covering:

• Login hour and day-of-week distribution
• Countries and ISPs (ASNs) that have successfully authenticated
• Form fill duration — your personal mean and variance
• Keystroke timing rhythm — your natural typing coefficient of variation
• Browser and device patterns
• Which usernames actually exist on this site

No data leaves your server. Everything is stored locally in your WordPress database using Welford’s online algorithm — a compact statistical method that maintains running mean and variance without storing individual data points.

Advisory Phase (Days 7–14)

Once enough legitimate logins have been recorded, the plugin begins scoring attempts and showing you what would have been blocked — without actually blocking anything yet. This lets you verify the model is accurate before enabling enforcement.

Active Phase (Day 14+)

With blocking enabled, attempts are scored in real time against your learned baseline. Suspicious attempts are challenged with a math-based security question and a tarpitting delay. High-confidence attacks are blocked outright.

Scoring System

Every login attempt receives a suspicion score from 0 to 100:

• 0 — Clean, matches your normal profile
• 20–39 — Low anomaly, monitored
• 40–59 — Medium anomaly, monitored
• 50–79 — Suspicious, challenged (math question + delay)
• 80–100 — High confidence attack, blocked

What It Detects

Immediate (from day one, no learning required)

• Honeypot field filled — hidden field invisible to real browsers
• Canary username targeted — attempts on usernames like admin or root that don’t exist on your site
• Known scripting tool user-agents — python-requests, curl, wget, sqlmap, nikto and others
• Direct POST attacks — bots that bypass the login form entirely and POST credentials directly
• XML-RPC brute force — including system.multicall batch attacks
• Impossibly fast form submission — sub-500ms fills

After baseline established (7–14 days)

• Login from a country never seen on this site
• Login from a new ISP or network
• Login attempt on a username that has never successfully authenticated here
• Login at an unusual hour for this site
• High velocity attempts from a single IP

After per-user profile established (20+ logins per user)

• Form fill time significantly outside your personal normal
• Keystroke rhythm significantly different from your established typing pattern

Site Hardening

Beyond login protection, Janric Shield also includes:

• REST API username decoy — unauthenticated requests to /wp-json/wp/v2/users receive convincing fake usernames instead of your real ones. The probe is logged and scored.
• XML-RPC control — monitor all XML-RPC calls (default) or disable the endpoint entirely
• WordPress version hiding — removes the version number from page source, RSS feeds, asset URLs, HTTP headers, and the REST API index

Privacy

Janric Shield operates entirely on your own server. No data is transmitted to any external service except for optional IP geolocation lookups (country and network type) which use the public ip-api.com service. IP addresses are stored as SHA-256 hashes in the attempt log. No personally identifiable information is shared with Janric or any third party.

For Developers

The plugin is structured around five core classes:

• JanricShield_Baseline — Welford online statistics engine, per-site and per-user profiles
• JanricShield_Scorer — Scores attempts against the learned baseline
• JanricShield_Capture — Hooks into WordPress authentication pipeline, captures behavioural signals
• JanricShield_Enforcer — Acts on scores based on current mode and thresholds
• JanricShield_DB — Database schema, migrations, and settings