Description
Open24 Security applies a set of well-known hardening measures to WordPress and WooCommerce sites from a single settings screen. Every option is off by default and can be switched on individually, so you decide exactly how much you want to restrict.
The plugin does not phone home, does not require an account and does not send any data to external services. The only outbound request it makes is to the official WordPress.org API, and only when you explicitly rotate your security keys.
Features
WordPress REST API
- Hide the /wp-json/wp/v2/users endpoint
- Require authentication on sensitive endpoints
- Disable the /wp-json/ index
Login
- Custom login URL (replace wp-login.php with your own slug)
- Limit login attempts per IP address
- Block common usernames such as admin or root
- Hide error hints that reveal whether a username exists
Protocols
- Disable XML-RPC
- Block external access to wp-cron.php
- Block user enumeration via ?author=N
Information disclosure
- Hide the WordPress version from the generator meta tag, asset query strings and RSS feeds
HTTP security headers
- X-Frame-Options, X-Content-Type-Options, Referrer-Policy
- Permissions-Policy, X-XSS-Protection
- Optional HSTS
WooCommerce
- Reject anonymous requests to the /wc/v3/ and /wc/v2/ REST routes
- Hide WooCommerce headers on the storefront
Tools
- Log out all users: rotates the WordPress security keys and salts, which invalidates every session cookie and immediately signs out all logged-in users. Useful after a suspected compromise or when an employee leaves.
- Change log: records which settings were changed and when.
Agency signature
- Adds an Open24 signature in the document head so the site can be identified as maintained by the agency by crawlers such as BuiltWith. This can be turned off.
About the security keys feature
Rotating the WordPress security keys requires updating the corresponding constants in wp-config.php. The plugin does this through the official WP_Filesystem API, writes to a temporary file with restrictive permissions and then moves it over the original in a single atomic operation, preserving the original file permissions. No backup copy is left anywhere on the server, and if any step fails, wp-config.php is left untouched.
If wp-config.php is not writable, the feature reports it and makes no changes.
Screenshots
Installation
- Upload the
open24-securityfolder to/wp-content/plugins/, or install the plugin through the WordPress plugins screen. - Activate the plugin through the Plugins menu in WordPress.
- Go to the “Open24 Security” menu to enable the options you need.
All options are disabled by default. Enable them one at a time and test your site after each change, especially the custom login URL and the REST API restrictions.
FAQ
-
Will this break my site?
-
Every option is off by default. The ones that need the most care are the custom login URL and the REST API restrictions, because some themes and plugins rely on those endpoints. Enable them one at a time and check your site afterwards.
-
I enabled the custom login URL and now I am locked out. What do I do?
-
Rename or delete the
open24-securityfolder in/wp-content/plugins/over FTP or your hosting file manager. The plugin will be deactivated and wp-login.php will work again. -
Does this plugin work without WooCommerce?
-
Yes. The WooCommerce options only appear when WooCommerce is active.
-
Does the plugin send data anywhere?
-
No. The only outbound request is to the official WordPress.org key generator API, and only when you choose to log out all users.
-
Why does logging out all users modify wp-config.php?
-
Because that is where WordPress stores the security keys and salts, as PHP constants. Changing them is what invalidates every session cookie. See the Description for details on how the file is written safely.
Reviews
There are no reviews for this plugin.
Contributors & Developers
“Open24 Security” is open source software. The following people have contributed to this plugin.
Contributors
Translate “Open24 Security” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
1.0.9
- Security keys are now written through the WP_Filesystem API instead of direct file writes.
- Removed the wp-config.php backup file that was left in the site root. It is no longer created.
- File permissions of wp-config.php are now preserved when rotating keys.
- All admin styles are now properly enqueued instead of being printed inline.
- Hardened input handling: all superglobals are unslashed and sanitized.
- All output is now escaped at the point of output.
- Internal redirects now use wp_safe_redirect().
- Readme and plugin headers translated to English.
1.0.0
- Initial release.