Title: Janric Shield Author: keithlunt Published: July 22, 2026 Last modified: July 22, 2026 --- Search plugins ![](https://ps.w.org/janric-shield/assets/banner-772x250.png?rev=3619199) This plugin **hasn’t been tested with the latest 3 major releases of WordPress**. It may no longer be maintained or supported and may have compatibility issues when used with more recent versions of WordPress. ![](https://ps.w.org/janric-shield/assets/icon-256x256.png?rev=3619199) # Janric Shield By [keithlunt](https://profiles.wordpress.org/keithlunt/) [Download](https://downloads.wordpress.org/plugin/janric-shield.1.0.0.zip) * [Details](https://wordpress.org/plugins/janric-shield/#description) * [Reviews](https://wordpress.org/plugins/janric-shield/#reviews) * [Installation](https://wordpress.org/plugins/janric-shield/#installation) * [Development](https://wordpress.org/plugins/janric-shield/#developers) [Support](https://wordpress.org/support/plugin/janric-shield/) ## Description Most WordPress security plugins protect sites by modelling attackers — maintaining lists of known bad IPs, known attack signatures, and known malicious patterns. Janric Shield takes the opposite approach. **Janric Shield models your legitimate users, not the attackers.** During a short learning phase it builds a behavioural profile of how your admins actually log in — when, where, from which networks, and how they interact with the login form. Once that profile is established, anything that deviates significantly from it is flagged as suspicious. A brand new attack tool, a previously unseen technique, a credential stuffing campaign — it doesn’t matter whether it appears on any blocklist. If it doesn’t look like you, it scores high. #### How It Works **Learning Phase (Days 1–14)** The plugin silently observes every login attempt and builds a per-site, per-user baseline covering: * Login hour and day-of-week distribution * Countries and ISPs (ASNs) that have successfully authenticated * Form fill duration — your personal mean and variance * Keystroke timing rhythm — your natural typing coefficient of variation * Browser and device patterns * Which usernames actually exist on this site No data leaves your server. Everything is stored locally in your WordPress database using Welford’s online algorithm — a compact statistical method that maintains running mean and variance without storing individual data points. **Advisory Phase (Days 7–14)** Once enough legitimate logins have been recorded, the plugin begins scoring attempts and showing you what _would_ have been blocked — without actually blocking anything yet. This lets you verify the model is accurate before enabling enforcement. **Active Phase (Day 14+)** With blocking enabled, attempts are scored in real time against your learned baseline. Suspicious attempts are challenged with a math-based security question and a tarpitting delay. High-confidence attacks are blocked outright. #### Scoring System Every login attempt receives a suspicion score from 0 to 100: * **0** — Clean, matches your normal profile * **20–39** — Low anomaly, monitored * **40–59** — Medium anomaly, monitored * **50–79** — Suspicious, challenged (math question + delay) * **80–100** — High confidence attack, blocked #### What It Detects **Immediate (from day one, no learning required)** * Honeypot field filled — hidden field invisible to real browsers * Canary username targeted — attempts on usernames like `admin` or `root` that don’t exist on your site * Known scripting tool user-agents — `python-requests`, `curl`, `wget`, `sqlmap`,` nikto` and others * Direct POST attacks — bots that bypass the login form entirely and POST credentials directly * XML-RPC brute force — including `system.multicall` batch attacks * Impossibly fast form submission — sub-500ms fills **After baseline established (7–14 days)** * Login from a country never seen on this site * Login from a new ISP or network * Login attempt on a username that has never successfully authenticated here * Login at an unusual hour for this site * High velocity attempts from a single IP **After per-user profile established (20+ logins per user)** * Form fill time significantly outside your personal normal * Keystroke rhythm significantly different from your established typing pattern #### Site Hardening Beyond login protection, Janric Shield also includes: * **REST API username decoy** — unauthenticated requests to `/wp-json/wp/v2/users` receive convincing fake usernames instead of your real ones. The probe is logged and scored. * **XML-RPC control** — monitor all XML-RPC calls (default) or disable the endpoint entirely * **WordPress version hiding** — removes the version number from page source, RSS feeds, asset URLs, HTTP headers, and the REST API index #### Privacy Janric Shield operates entirely on your own server. No data is transmitted to any external service except for optional IP geolocation lookups (country and network type) which use the public ip-api.com service. IP addresses are stored as SHA-256 hashes in the attempt log. No personally identifiable information is shared with Janric or any third party. #### For Developers The plugin is structured around five core classes: * `JanricShield_Baseline` — Welford online statistics engine, per-site and per- user profiles * `JanricShield_Scorer` — Scores attempts against the learned baseline * `JanricShield_Capture` — Hooks into WordPress authentication pipeline, captures behavioural signals * `JanricShield_Enforcer` — Acts on scores based on current mode and thresholds * `JanricShield_DB` — Database schema, migrations, and settings ## Installation 1. Upload the `janric-shield` folder to `/wp-content/plugins/` 2. Activate the plugin through the **Plugins** menu in WordPress 3. Navigate to **Janric Shield** in the admin menu 4. Leave the plugin in Learning mode and use your site normally for 1–2 weeks 5. Review the attempt log to confirm the model is learning your pattern correctly 6. Enable blocking when you are confident in the baseline **Important:** Do not enable Active mode with blocking on during the Learning phase. The plugin will warn you if confidence is too low. ## FAQ ### Will it block me out of my own site? No — during Learning mode it only observes. During Advisory mode it scores but never blocks. Blocking only activates in Active mode, and only when you explicitly enable it. There is always a manual override switch in the admin dashboard. ### How long does learning take? Advisory mode activates after 20 successful logins over at least 7 days. Active mode becomes available after 50 successful logins over 14 days. A confidence indicator in the dashboard shows your current progress. ### I use a password manager. Will that affect my score? No. Password managers auto-fill without firing keydown events, producing a keystroke CV of zero. Janric Shield explicitly detects this pattern — zero keystroke variance combined with mouse or touch interaction — and treats it as a password manager fill, not a bot. No penalty is applied. ### I logged in from a new country and got flagged. Is that right? Yes, and that is the intended behaviour. A login from a country you have never used before is a genuine anomaly worth flagging. In Learning or Advisory mode it is just recorded. In Active mode with a moderate threshold it would be challenged, not blocked outright. You can log in normally and the challenge takes only a few seconds. ### Does it work on mobile? Yes. The JavaScript capture layer detects both mouse events (desktop) and touch events (mobile), combining them so that a tap on the login button correctly registers as human interaction. ### Can I use XML-RPC with the plugin active? Yes. By default XML-RPC is monitored but not blocked — all calls are logged and scored. If you do not use the WordPress mobile app or Jetpack you can disable XML- RPC entirely from the Hardening panel in the dashboard. ### Does the plugin share data with other sites? No. This version operates entirely locally. Each install builds and uses its own independent baseline. There is no federated network or central reporting in this release. ### What PHP version is required? PHP 7.4 or higher. The plugin includes polyfills for `str_contains()`, `str_starts_with()`, and `str_ends_with()` which are native only in PHP 8.0+. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “Janric Shield” is open source software. The following people have contributed to this plugin. Contributors * [ keithlunt ](https://profiles.wordpress.org/keithlunt/) [Translate “Janric Shield” into your language.](https://translate.wordpress.org/projects/wp-plugins/janric-shield) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/janric-shield/), check out the [SVN repository](https://plugins.svn.wordpress.org/janric-shield/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/janric-shield/) by [RSS](https://plugins.trac.wordpress.org/log/janric-shield/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.0.0 * Initial release * Per-site and per-user baseline learning using Welford’s online algorithm * Behavioural biometric capture — form duration, keystroke CV, mouse and touch events * Honeypot and canary username detection * REST API username decoy * XML-RPC monitoring and optional disable * WordPress version hiding * Three-mode operation: Learning, Advisory, Active * Math challenge with tarpitting for suspicious attempts * Admin dashboard with live attempt log and confidence indicator ## Meta * Version **1.0.0** * Last updated **3 days ago** * Active installations **Fewer than 10** * WordPress version ** 5.0 or higher ** * Tested up to **6.7.5** * PHP version ** 7.4 or higher ** * Tags * [Brute Force](https://wordpress.org/plugins/tags/brute-force/)[login](https://wordpress.org/plugins/tags/login/) [machine learning](https://wordpress.org/plugins/tags/machine-learning/)[protection](https://wordpress.org/plugins/tags/protection/) [security](https://wordpress.org/plugins/tags/security/) * [Advanced View](https://wordpress.org/plugins/janric-shield/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/janric-shield/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/janric-shield/reviews/) ## Contributors * [ keithlunt ](https://profiles.wordpress.org/keithlunt/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/janric-shield/)