Title: KUMITATE HOSHU Author: MOTOKI Published: October 25, 2026 Last modified: October 25, 2026 --- Search plugins ![](https://s.w.org/plugins/geopattern-icon/kumitate-hoshu.svg) # KUMITATE HOSHU By [MOTOKI](https://profiles.wordpress.org/motok1/) [Download](https://downloads.wordpress.org/plugin/kumitate-hoshu.0.2.0.zip) * [Details](https://wordpress.org/plugins/kumitate-hoshu/#description) * [Reviews](https://wordpress.org/plugins/kumitate-hoshu/#reviews) * [Installation](https://wordpress.org/plugins/kumitate-hoshu/#installation) * [Development](https://wordpress.org/plugins/kumitate-hoshu/#developers) [Support](https://wordpress.org/support/plugin/kumitate-hoshu/) ## Description KUMITATE HOSHU (“kumitate-hoshu” is Japanese for protection) closes the ways most WordPress sites get broken into, with as little to configure as possible. Activate it and the protections that cannot lock you out are already on. Everything else is one switch, explained in plain words. **Login** * Limit login attempts: repeated failures from one address or for one user name are refused for a while, and the password is not even checked during the lock. * Two-factor login: each user can add a time-based code from Google Authenticator, Microsoft Authenticator, Authy, 1Password or any other authenticator app, with single-use recovery codes. * Change the login address (off by default): serve the login page at an address of your choosing and answer wp-login.php and the admin area with “not found” for visitors. **Fewer ways in** * Hide user names: the author archive by number, the public users endpoint of the REST API, the users sitemap and login errors that confirm a name all stop giving names away. * Close unused doors: XML-RPC and pingbacks off, the theme and plugin file editors removed, the WordPress version hidden. * Security headers: X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy on every response. **Checks** * Settings check: a score out of 100 and a list of what to fix and how, from debug output to a user named “admin”, PHP files in uploads, missing secret keys and waiting updates. * File integrity: the WordPress files on the server compared with the official list from WordPress.org, weekly and on demand; changed, missing and unexpected files are listed. * Known vulnerabilities: installed plugins, themes and WordPress compared with a public vulnerability list, weekly and on demand. * A log of logins, locks, backups, updates and checks, kept for 90 days and at most 20,000 entries, with addresses stored as hashes. **Keep** * Backups: wp-content and the database in one .wpress file, the format All-in-One WP Migration (ServMask Inc.) imports, so a backup can also move a site elsewhere. Made by hand or every day or week, kept in a folder closed to visitors, with a chosen number of generations, and downloadable from the same screen. Restore from there too; the current state is backed up first. A .wpress from another site can be uploaded on the same screen and restored, with addresses and paths rewritten. * Automatic updates with a backup first: once a day, waiting plugin and theme updates are installed after a backup; the front and login pages are checked, and if the site stopped answering properly the updated items are put back from that backup and you get an e-mail. Plugin Check notes a “plugin updater”: that is the automatic-updates feature above, which installs updates from WordPress.org through the normal WordPress upgrader. The plugin never changes where updates come from. What this plugin does not do: it cannot protect the web server or operating system, stop a denial-of-service attack, or help once an attacker can already run PHP on the server. Keep WordPress, plugins and themes updated and keep backups away from the server. ### External services Nothing is downloaded or sent until you turn on “Allow connections to WordPress. org and the vulnerability list” under KUMITATE HOSHU > Settings. * **WordPress.org** (api.wordpress.org): the file integrity check downloads the official checksum list for the installed WordPress version and locale. The request carries the version and locale. [Privacy policy](https://wordpress.org/about/privacy/) * **Wordfence Intelligence** by Defiant Inc. (www.wordfence.com): the vulnerability check downloads the public vulnerability list and compares it on your server with the installed plugin, theme and WordPress versions. No information about your site is sent; only matching entries are kept. [Terms](https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/)· [Privacy policy](https://www.defiant.com/privacy-policy/) ## Installation 1. Upload the plugin folder to /wp-content/plugins/ or install it from the Plugins screen. 2. Activate it. Login limits, user name hiding, hardening, headers and the settings check are on at once. 3. Open KUMITATE HOSHU in the admin menu, read the settings check, and turn on the external connection if you want the file and vulnerability checks. 4. On your profile, set up two-factor login and keep the recovery codes somewhere safe. ## FAQ ### I changed the login address and forgot it Add `define( 'KUMITATE_HOSHU_LOGIN_URL_OFF', true );` to wp-config.php. The usual wp-login.php address then works again. ### I lost my authenticator device Log in with one of your recovery codes, then on your profile turn two-factor login off and set it up again. An administrator can also turn it off for another user from that user’s profile. ### Does two-factor login cover every way in? It covers the login form, including custom login forms that use wp_signon(). XML- RPC and application passwords authenticate without the form and are not asked for a code, so keep “Close unused doors” on (it turns XML-RPC off) and give application passwords only to users who need them. ### Jetpack or the mobile app stopped working They use XML-RPC. Turn off “Close unused doors” under KUMITATE HOSHU > Settings, or ask on the support forum for a finer switch. ### Can All-in-One WP Migration really read these backups? The file layout and database format follow that plugin’s own archiver; backups made here were imported with its version 7.112 during development, with plugins and the theme re-activated by it afterwards. Save the permalink settings once after an import. Its free version limits the size of an import uploaded through the browser; large sites are restored with KUMITATE HOSHU itself, or imported with that plugin’s paid extension. ### Where are backups stored, and are they safe? Under wp-content/uploads/kumitate-hoshu/backups, with a random part in each file name and an .htaccess that denies web access on Apache. On nginx the folder is not denied automatically: add a location rule for /wp-content/uploads/kumitate-hoshu/ that returns 403. Download backups regularly and keep them away from the server; they contain your database, so treat them as confidential. ### Does it work with a caching plugin or a CDN? Yes. The protections run on login and admin requests, which are not cached. Security headers on cached pages are sent only when the cache was filled with the plugin active. ### What about the server behind a proxy or load balancer? Login limits use the address the web server reports. If your host puts a proxy in front and every visitor appears to share one address, add a filter on `kumitate_hoshu_client_ip` that returns the real address from the header your host documents, and only that header. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “KUMITATE HOSHU” is open source software. The following people have contributed to this plugin. Contributors * [ MOTOKI ](https://profiles.wordpress.org/motok1/) “KUMITATE HOSHU” has been translated into 1 locale. Thank you to [the translators](https://translate.wordpress.org/projects/wp-plugins/kumitate-hoshu/contributors) for their contributions. [Translate “KUMITATE HOSHU” into your language.](https://translate.wordpress.org/projects/wp-plugins/kumitate-hoshu) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/kumitate-hoshu/), check out the [SVN repository](https://plugins.svn.wordpress.org/kumitate-hoshu/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/kumitate-hoshu/) by [RSS](https://plugins.trac.wordpress.org/log/kumitate-hoshu/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 0.2.0 * Backups in .wpress form, by hand or on a schedule, with restore and a pre-restore safety backup. * Automatic plugin and theme updates with a backup first, a health check and rollback from the backup. #### 0.1.0 * First release: login limits, two-factor login, login address change, user name hiding, hardening, security headers, settings check, file integrity check, vulnerability check, log. ## Meta * Version **0.2.0** * Last updated **3 days ago** * Active installations **Fewer than 10** * WordPress version ** 6.6 or higher ** * Tested up to **7.1.3** * PHP version ** 7.4 or higher ** * Languages * [English (US)](https://wordpress.org/plugins/kumitate-hoshu/) and [Japanese](https://ja.wordpress.org/plugins/kumitate-hoshu/). * [Translate into your language](https://translate.wordpress.org/projects/wp-plugins/kumitate-hoshu) * Tags * [backup](https://wordpress.org/plugins/tags/backup/)[hardening](https://wordpress.org/plugins/tags/hardening/) [login](https://wordpress.org/plugins/tags/login/)[security](https://wordpress.org/plugins/tags/security/) [two factor](https://wordpress.org/plugins/tags/two-factor/) * [Advanced View](https://wordpress.org/plugins/kumitate-hoshu/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/kumitate-hoshu/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/kumitate-hoshu/reviews/) ## Contributors * [ MOTOKI ](https://profiles.wordpress.org/motok1/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/kumitate-hoshu/)