Description
Rooted Dev Studio Security Toolkit provides a transparent baseline for protecting a WordPress website without hiding important behavior behind vague scores or destructive automatic fixes.
Features include:
- Configurable failed-login limiting with short, per-login-and-IP temporary lockouts.
- Administrator controls for reviewing and clearing active Rooted Dev Studio Security Toolkit lockouts.
- Time-based two-factor authentication with single-use recovery codes.
- A local Security Timeline for important authentication, administration, hardening, and file events.
- Hashed origin records without storing raw IP addresses in security events.
- Baseline browser security headers.
- Reversible theme and plugin editor protection.
- Optional XML-RPC authentication restriction.
- Optional public REST user endpoint restriction.
- Security configuration checks for HTTPS, updates, debug display, administrator access, WordPress salts, and PHP.
- Read-only file fingerprinting with expected and unexplained change review.
- A bounded, manual suspicious-code scan for selected high-risk PHP patterns.
- Email alerts for important software and administrator changes and repeated-login lockouts.
- Local retention controls and automatic cleanup.
Rooted Dev Studio Security Toolkit does not transmit site data to Rooted Dev Studio or any third party. It does not execute, edit, quarantine, restore, or delete scanned files. A clean scan is not a guarantee that a website is free of malicious code. Rooted Dev Studio Security Toolkit does not replace secure hosting, backups, software updates, or professional incident response.
Installation
- Upload the
rooted-securityfolder to/wp-content/plugins/, or install the ZIP through Plugins > Add New > Upload Plugin. - Activate Rooted Dev Studio Security Toolkit.
- Open Rooted Dev Studio Security Toolkit > Dashboard.
- Review Rooted Dev Studio Security Toolkit > Settings before enabling compatibility-sensitive options.
- Configure two-factor authentication from each administrator’s WordPress profile and store recovery codes securely.
- Create a file-monitor baseline only after confirming the website is in a known-good state.
FAQ
-
Does Rooted Dev Studio Security Toolkit send my site data anywhere?
-
No. Rooted Dev Studio Security Toolkit Free has no telemetry, remote API, account requirement, or external service connection.
-
Does the suspicious-code scan prove my website is clean?
-
No. The bounded, read-only scanner looks for selected high-risk PHP patterns in active themes and plugins. Findings require review, and a clean result cannot detect every malware family or hidden compromise.
-
Why are XML-RPC and REST user restrictions disabled by default?
-
Those options can affect mobile apps, publishing tools, and integrations. Rooted Dev Studio Security Toolkit keeps compatibility-sensitive controls opt-in.
-
Are IP addresses stored?
-
Raw IP addresses are not written to the activity table. Rooted Dev Studio Security Toolkit stores a keyed hash so repeated events can be correlated without retaining the original address.
-
Can login protection lock every visitor out of an account?
-
No. Temporary lockouts are tied to the matching login value and the server-observed IP address. Password-reset access remains available, active administrators can clear Rooted Dev Studio Security Toolkit lockouts, and a file-access recovery constant is documented on the Login Protection screen.
-
Does Rooted Dev Studio Security Toolkit automatically change or delete suspicious files?
-
No. File monitoring and suspicious-code scanning are review tools. Rooted Dev Studio Security Toolkit does not automatically modify, quarantine, restore, or delete files.
Reviews
There are no reviews for this plugin.
Contributors & Developers
“Rooted Dev Studio Security Toolkit” is open source software. The following people have contributed to this plugin.
Contributors
Translate “Rooted Dev Studio Security Toolkit” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
0.2.1
- Renamed the plugin for a distinctive WordPress.org identity.
0.2.0
- Added local two-factor authentication and single-use recovery codes.
- Added the local Security Timeline and dashboard summary.
- Added reversible hardening controls and review history.
- Added read-only file fingerprinting and expected-change review.
- Added a bounded manual suspicious-code scanner with PHP comment filtering.
- Added windowed login limiting, administrator lockout recovery, timeline events, and anti-flood email alerts.
- Expanded privacy, safety-scope, and uninstall cleanup documentation.
- Addressed WordPress Plugin Check translation, request-validation, package, and database-query findings.
- Corrected translator-comment placement in administrative templates.
- Normalized production source-file line endings.