{"id":214443,"date":"2025-03-19T16:38:04","date_gmt":"2025-03-19T16:38:04","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/secure-setup\/"},"modified":"2025-04-17T13:17:32","modified_gmt":"2025-04-17T13:17:32","slug":"secure-setup","status":"closed","type":"plugin","link":"https:\/\/wordpress.org\/plugins\/secure-setup\/","author":23198668,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"1.0.2","stable_tag":"1.0.2","tested":"6.8.5","requires":"5.2","requires_php":"7.2","requires_plugins":null,"header_name":"Secure Setup","header_author":"Deep","header_description":"This plugin helps secure your WordPress website by implementing various security measures.","assets_banners_color":"358b72","last_updated":"2025-04-17 13:17:32","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"https:\/\/deeprahman.com\/wp-secure-setup","header_author_uri":"https:\/\/deeprahman.com\/","rating":0,"author_block_rating":0,"active_installs":0,"downloads":651,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"1.0.1":{"tag":"1.0.1","author":"deepwebdev","date":"2025-03-19 16:37:30"},"1.0.2":{"tag":"1.0.2","author":"deepwebdev","date":"2025-04-17 13:17:32"}},"upgrade_notice":{"1.0.0":"

Initial release. Ensure your PHP version is 7.2 or higher and WordPress is updated to the latest version.<\/p>"},"ratings":[],"assets_icons":{"icon-256x256.png":{"filename":"icon-256x256.png","revision":3258676,"resolution":"256x256","location":"assets","locale":""}},"assets_banners":{"banner-772x250.png":{"filename":"banner-772x250.png","revision":3258676,"resolution":"772x250","location":"assets","locale":""}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0.1","1.0.2"],"block_files":[],"assets_screenshots":[],"screenshots":{"1":"Settings Page<\/strong> - The File Permission settings and .htaccess<\/code> configuration panel.","2":"Recommended File Permissions<\/strong> - Displays the recommended permissions for a secure WordPress setup."},"jetpack_post_was_ever_published":false},"plugin_section":[],"plugin_tags":[239739,1329,23853,600,1173],"plugin_category":[54],"plugin_contributors":[239740],"plugin_business_model":[],"class_list":["post-214443","plugin","type-plugin","status-closed","hentry","plugin_tags-file-permissions","plugin_tags-htaccess","plugin_tags-rest-api","plugin_tags-security","plugin_tags-wordpress-security","plugin_category-security-and-spam-protection","plugin_contributors-deeprahman","plugin_committers-deepwebdev"],"banners":[],"icons":{"svg":false,"icon":"https:\/\/s.w.org\/plugins\/geopattern-icon\/secure-setup_358b72.svg","icon_2x":false,"generated":true},"screenshots":[],"raw_content":"\n

Securing Setup<\/strong> helps protect your WordPress installation by:\n1. Allowing users to set recommended file permissions for directories and subdirectories.\n2. Automatically modifying the .htaccess<\/code> file to:\n - Protect the debug.log<\/code> file from being accessed via the web.\n - Restrict execution of specific file types (e.g., .png<\/code>, .jpg<\/code>), ensuring only selected file types are processed by the web server.\n3. Disabling sensitive WordPress endpoints such as:\n - system.multicall<\/code> from XML-RPC.\n - The users<\/code> endpoint in the REST API.<\/p>\n\n

The plugin is user-friendly and includes an easy-to-access settings page.<\/p>\n\n

You can view or contribute to the plugin's source code on GitHub:\n[GitHub Repository]https:\/\/github.com\/deeprahman\/sswp)<\/p>\n\n

Features<\/h3>\n\n
    \n
  • Set directory and subdirectory permissions for enhanced security.<\/li>\n
  • Automate .htaccess<\/code> file modifications.<\/li>\n
  • Disable potentially vulnerable endpoints.<\/li>\n
  • Tested with the latest version of WordPress.<\/li>\n<\/ul>\n\n

    Notes<\/h3>\n\n

    After activation, the plugin adds a submenu named File Permission<\/strong> under the Tools menu, where you can configure settings.<\/p>\n\n\n

      \n
    1. Upload the securing-setup<\/code> folder to the \/wp-content\/plugins\/<\/code> directory.<\/li>\n
    2. Activate the plugin through the 'Plugins' menu in WordPress.<\/li>\n
    3. Navigate to Tools > File Permission<\/strong> to configure settings.<\/li>\n<\/ol>\n\n\n
      \n

      What are recommended file permissions?<\/h3><\/dt>\n

      The plugin will recommend secure file permissions (e.g., 755<\/code> for directories and 644<\/code> for files) to reduce risks from unauthorized access.<\/p><\/dd>\n

      Can I undo `.htaccess` modifications?<\/h3><\/dt>\n

      Yes, the plugin provides options to revert changes made to the .htaccess<\/code> file.<\/p><\/dd>\n

      Will this plugin break my media uploads or other file handling?<\/h3><\/dt>\n

      No, you can configure which file types are allowed for execution by the web server, ensuring normal functionality.<\/p><\/dd>\n

      What endpoints are disabled by this plugin?<\/h3><\/dt>\n

      The plugin disables:\n- The system.multicall<\/code> function in XML-RPC to prevent potential attacks.\n- The users<\/code> endpoint in the REST API to hide user enumeration.<\/p><\/dd>\n\n<\/dl>\n\n\n

      1.0.2<\/h4>\n\n
        \n
      • Readme updated<\/li>\n<\/ul>\n\n

        1.0.1<\/h4>\n\n
          \n
        • Added OS warning.<\/li>\n
        • Implemented REST API rate limiting.<\/li>\n<\/ul>\n\n

          1.0.0<\/h4>\n\n
            \n
          • Initial release.<\/li>\n
          • File permissions management for directories and files.<\/li>\n
          • .htaccess<\/code> customization for secure file handling.<\/li>\n
          • Disabled system.multicall<\/code> and users<\/code> REST endpoint for added protection.<\/li>\n
          • <\/li>\n<\/ul>","raw_excerpt":"Enhance WordPress security by setting recommended file permissions, securing .htaccess, and disabling sensitive endpoints.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/214443","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=214443"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/deepwebdev"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=214443"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=214443"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=214443"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=214443"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=214443"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=214443"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}