Cloudflare API<\/strong> (https:\/\/api.cloudflare.com\/client\/v4), only after you save a Cloudflare API token of your own on Settings \u2192 Hardening \u2192 Sign-in and server, and only for what you press there or switch on. That is:<\/p>\n\n\n- listing the zones the token can see<\/li>\n
- reading a zone's custom firewall and rate-limit rules (Preview)<\/li>\n
- reading the zone's cache rules, once a day, for the self-check (read only)<\/li>\n
- adding, changing or putting back rules (Apply, Undo, Copy)<\/li>\n
- sending the probe ban's addresses as IP access rules (Send them now)<\/li>\n
- with \"When a page changes, have Cloudflare forget it\" (or DoctorX Command Center's \"Empty caches\"), the addresses of changed pages or a \"forget everything\" request.<\/li>\n<\/ul>\n\n
Sent: the token (as the request's authorisation), the zone's id, the rules this plugin generates (your host names, your trusted addresses, the hidden door's address when it is on), banned internet addresses, and page addresses. Nothing about your visitors or accounts is sent. Cloudflare's terms: https:\/\/www.cloudflare.com\/website-terms\/ and privacy policy: https:\/\/www.cloudflare.com\/privacypolicy\/<\/p><\/li>\n
- ipinfo.io<\/strong> (https:\/\/ipinfo.io), only when you choose \"ipinfo.io\" under \"Where addresses are\" on the activity record's More settings screen, save your own token, and an administrator opens an address in the record: that one internet address and your token. ipinfo's terms: https:\/\/ipinfo.io\/terms-of-service and privacy policy: https:\/\/ipinfo.io\/privacy-policy<\/li>\n
- Google Maps Static API<\/strong> (https:\/\/maps.googleapis.com), only when you switch on the sign-in map and save your own Google Maps key, and only when an administrator opens the map. Sent: up to 60 rounded map points (latitude and longitude to three decimals, about 100 metres) and your key. No addresses, names or accounts are sent. Google's terms: https:\/\/cloud.google.com\/maps-platform\/terms and privacy policy: https:\/\/policies.google.com\/privacy<\/li>\n
- Alerts<\/strong>, only to the destinations you add on the activity record's More settings screen (Alerts) and only for the rules you set. Sent: the alert's subject, text and a link to the record. For a webhook, also your site's address, the rule's name and the event (as below). The destinations can be:\n\n
\n- Slack (the webhook address you paste). Terms https:\/\/slack.com\/main-services-agreement and privacy https:\/\/slack.com\/trust\/privacy\/privacy-policy<\/li>\n
- Discord. Terms https:\/\/discord.com\/terms and privacy https:\/\/discord.com\/privacy<\/li>\n
- Microsoft Teams. Terms https:\/\/www.microsoft.com\/en-us\/servicesagreement and privacy https:\/\/www.microsoft.com\/en-us\/privacy\/privacystatement<\/li>\n
- Telegram (api.telegram.org with your bot's token and chat). Terms https:\/\/telegram.org\/tos and privacy https:\/\/telegram.org\/privacy<\/li>\n
- any address of your own that takes JSON, signed with your secret if you set one.<\/li>\n<\/ul><\/li>\n
- Log forwarding<\/strong>, only when you switch it on on the activity record's More settings screen and switch on a destination with its connection details. Sent: every event as it is written, with its date, kind, level, message, who did it (user id, login and email address), the internet address and any addresses passed on by a proxy, the browser's user agent, what it was about, the event's details and your site's address. (Writing to this server's own system log is not an outside service and also happens on a website set up not to send.) The destinations can be:\n\n
\n- this server's own system log<\/li>\n
- a syslog server you name (UDP, TCP or TLS)<\/li>\n
- Datadog's Logs API with your key. Terms https:\/\/www.datadoghq.com\/legal\/terms\/ and privacy https:\/\/www.datadoghq.com\/legal\/privacy\/<\/li>\n
- Splunk's HTTP Event Collector with your token. Terms https:\/\/www.splunk.com\/en_us\/legal\/splunk-general-terms.html and privacy (Splunk is part of Cisco) https:\/\/www.cisco.com\/site\/us\/en\/about\/legal\/privacy.html<\/li>\n
- any webhook address of yours.<\/li>\n<\/ul><\/li>\n
- WordPress.org<\/strong> (https:\/\/api.wordpress.org), only when you switch on \"Check WordPress's own files once a day\" in the activity record's settings: once a day, your WordPress version and language, to fetch the official checksums of WordPress's files (the same request WordPress makes for its own updates). WordPress.org's privacy policy: https:\/\/wordpress.org\/about\/privacy\/<\/li>\n
- Your server's DNS resolver<\/strong>, only when you switch on \"Also ask for the address's host name\" and an administrator opens an address in the record: that one internet address, to look up its host name (reverse DNS).<\/li>\n
- The emails this plugin sends (sign-in codes, the hidden door's address, notes about two-step sign-in) go through your site's own mail setup to your own people.<\/li>\n
- Your own site's address<\/strong>, once a day, for the self-check: a few requests to your own site (a probe file in each private folder and a private probe page), which pass through your proxy or CDN if you have one. Nothing is sent to anybody else.<\/li>\n
- The crawler-list script on the \"Lines for your web server\" screen is a file you download and run on your server yourself: it fetches the address lists Google, Bing and Cloudflare publish (developers.google.com, www.bing.com, www.cloudflare.com). The plugin itself does not fetch them.<\/li>\n<\/ul>\n\n
Source code and credits<\/h3>\n\n
All code is included unminified. The picture you scan when setting up two-step sign-in is drawn in the browser by QR Code Generator for JavaScript by Kazuhiko Arase (MIT licence), included unchanged in assets\/vendor\/qrcode-generator.js. The word \"QR Code\" is a registered trademark of DENSO WAVE INCORPORATED.<\/p>\n\n\n
\n- In your WordPress dashboard go to Plugins \u2192 Add New, search for \"DoctorX Hardening\", press Install, then Activate.<\/li>\n
- That is all. The protections in \"What it does as soon as you turn it on\" are now working. Open Settings \u2192 Hardening to see them, and switch off any you do not want.<\/li>\n
- To add a phone code to your own sign-in, go to Users \u2192 Two-step sign-in (or Profile \u2192 Two-step sign-in). You need a free authenticator app on your phone, such as Google Authenticator or Microsoft Authenticator. It takes about two minutes. Keep the backup codes it gives you somewhere safe.<\/li>\n
- Optional: to keep an activity record, tick \"Keep an activity record\" on Settings \u2192 Hardening. You will find it under Tools \u2192 Activity.<\/li>\n
- Optional: for a security.txt file, type a contact email on Settings \u2192 Hardening and press Save.<\/li>\n<\/ol>\n\n\n
\nWhat are the limits of each protection?<\/h3><\/dt>\nThe fine print, so that nobody relies on more than is there:<\/p>\n\n
\n- Hidden plugin list:<\/strong> only the list is hidden. A person who already knows or guesses a plugin can still find it in other ways.<\/li>\n
- Two-step sign-in<\/strong> works on normal sign-in pages, including most shop and membership plugins. Apps that sign in with a plain password are refused for an account that has it on. Give each app its own app password instead (at the bottom of your profile). Sign-in through another service, such as \"Sign in with Google\", does not pass through it.<\/li>\n
- Wrong codes are limited:<\/strong> 5 wrong codes in 15 minutes, or 20 in a day, pause the code step. The person is emailed. While it is paused the real person cannot sign in either, so set a new password if someone else knows yours. A new password ends the pause.<\/li>\n
- Any administrator can switch two-step sign-in off for everybody.<\/strong> When that is done on the settings screen or the Plugins screen, everybody who used it is emailed. If it is switched off in some other way (by editing files or the database), nobody is told.<\/li>\n
- The emergency line<\/strong> DOCTORX_HARDENING_NO_TWO_STEP in wp-config.php turns the phone code off for every account. It is for a locked-out owner, only for as long as needed.<\/li>\n
- Multisite networks<\/strong> do not get two-step sign-in or the hidden sign-in page.<\/li>\n
- The phone app's secret key<\/strong> is stored encrypted with your site's security keys. If your host changes those keys, everybody sets two-step sign-in up again (backup codes still work to get in).<\/li>\n
- security.txt<\/strong> is a notice, not a lock. It makes it easy for an honest person to reach you.<\/li>\n
- The password-guess lockout<\/strong> counts by internet address. Many people can share one address, such as an office, and a lockout holds for all of them. That is why you can list trusted addresses, and why an address an administrator used is only ever paused for an hour. A site behind a proxy or Cloudflare must name it in the settings, or every visitor looks like the same address.<\/li>\n
- The hidden sign-in page<\/strong> hides the page. It is not a lock. Anyone who learns the address can still try, and the lockout and phone code still apply.<\/li>\n
- The scanner block<\/strong> only sees requests that reach WordPress. Your web server may answer some of them first. The web server lines and Cloudflare rules cover those.<\/li>\n
- A code by email<\/strong> is weaker than the phone app. Whoever has both the password and the email account gets in.<\/li>\n
- Cloudflare's free plan<\/strong> allows five custom rules and one rate limit rule. The DoctorX rules use two or three and the rate limit.<\/li>\n
- The web server lines<\/strong> are text for a person to put in place. The plugin cannot check that they were.<\/li>\n<\/ul><\/dd>\n
Will the block editor or the mobile app still work?<\/h3><\/dt>\nThe block editor, yes. People who work on the site, and apps that sign in as them with an application password, still get the full list of what the site can do. A signed-in customer or subscriber gets the answer without the list, like a visitor. The list of user accounts stays readable to anybody who is signed in, as WordPress has it. Only visitors lose it.<\/p>\n\n
One thing changes for apps. An app that signs in with the ordinary password of an account that has two-step sign-in on is refused: give it an application password instead (see \"What about apps and services that sign in with my password?\" below).<\/p><\/dd>\n
My theme shows author names under each post. Do they disappear?<\/h3><\/dt>\nNo. The author's display name still shows. Only the link behind it now points to the home page instead of an author page.<\/p><\/dd>\n
I use an SEO plugin that makes its own author sitemap.<\/h3><\/dt>\nThis plugin only removes authors from WordPress's built-in sitemap. Turn off author sitemaps in your SEO plugin too.<\/p><\/dd>\n
Something on my site stopped finding its way after I updated.<\/h3><\/dt>\nA few outside apps, and scripts in some themes, read the list at \/wp-json\/ without signing in, to find out what the site offers. Untick \"Hide the list of what your site can do from visitors\" and it is as before. A developer can instead keep one part of the list open with the doctorx_hardening_open_rest_namespaces<\/code> filter.<\/p><\/dd>\nWhich authenticator app do I need?<\/h3><\/dt>\nAny app that makes six-digit sign-in codes that change every 30 seconds. Your phone's app shop has several free ones, and most password managers do it too. Nothing has to be bought and no account has to be opened anywhere.<\/p><\/dd>\n
I lost my phone. How do I get in?<\/h3><\/dt>\nType one of your backup codes where the sign-in page asks for the six-digit code. Each works once. Then switch two-step sign-in off under Users (or Profile) \u2192 Two-step sign-in, with another backup code, and set it up again on the new phone.<\/p><\/dd>\n
I lost my phone and my backup codes.<\/h3><\/dt>\nSomebody who may edit your account (on most sites, another administrator) can switch two-step sign-in off for you: Users, your name, \"Switch it off for this account\". An email about it goes to your address.<\/p>\n\n
If you are the only administrator, add this line to wp-config.php, above the line that says \"That's all, stop editing\" (your web host can do this for you):<\/p>\n\n
define( 'DOCTORX_HARDENING_NO_TWO_STEP', true );\n<\/code><\/pre>\n\nNobody is asked for a code while the line is there, on any account: every account opens with its password alone. So do it only when nobody else can know your password or the password of any other account that can change the site (if in doubt, have new passwords set first), and for as short a time as you can. Somebody who signs in while the line is there stays signed in after it is taken out, until they sign out or their password is changed. Sign in, open Users \u2192 Two-step sign-in, and press \"Switch two-step sign-in off\": while the line is there, that button asks for no code. Set it up again with your new phone, and take the line out.<\/p><\/dd>\n
It says \"too many wrong sign-in codes\", and it was not me.<\/h3><\/dt>\nThen somebody typed your password correctly and guessed at the code. The lock stopped the guessing. Use \"Lost your password?\" on the sign-in page to set a new password: that shuts them out and opens the lock, and you sign in with your new password and a code as usual.<\/p>\n\n
If the email with the link does not arrive, another administrator can set a new password for you on your profile (Users, your name), which opens the lock too. If you are the only administrator, ask your web host to set a new password for your account: hosts can do that without signing in to the site. The stranger is then out, and you sign in with the new password and a code (if the lock is still on, it opens at the time the page shows).<\/p>\n\n
Do not add the wp-config.php line from the answer above while somebody else knows your password. That line switches the second step off for every account, so the stranger would be signed in with the password alone. Change the password first. Use the line only for a lost phone.<\/p>\n\n
If your site's \"Lost your password?\" page belongs to a shop or membership plugin, and your WordPress is a release from before November 2024, a password set there may not open the lock. It then opens at the time shown, or when the password is changed on the profile screen.<\/p><\/dd>\n
Nobody's codes work any more.<\/h3><\/dt>\nThe codes depend on the time. If everybody's codes fail at once, the clock of the website's server is probably wrong by more than half a minute: ask your web host to check it. If only yours fail, check that your phone sets its clock automatically.<\/p><\/dd>\n
Does two-step sign-in apply to everybody? Can I make it compulsory?<\/h3><\/dt>\nEach person switches it on for their own account. Settings \u2192 Hardening shows how many of the site's administrators have it on. To make it compulsory for some roles, from a date, use \"Two-step sign-in required\" on Settings \u2192 Hardening \u2192 Sign-in and server.<\/p><\/dd>\n
What about apps and services that sign in with my password?<\/h3><\/dt>\nAn account with two-step sign-in can no longer be used with just its password by a program (XML-RPC, a script, a sign-in box that works without loading a page): there would be nowhere to ask for the code. Give each app its own application password, at the bottom of your profile (if there is no \"Application Passwords\" section there, another plugin or your web host has switched them off). That is safer anyway: you can take one app's key away without changing your password.<\/p><\/dd>\n
Our host changed the site's \"security keys\" (salts), and now nobody's codes work.<\/h3><\/dt>\nThe key each app shares with the site is kept encrypted with your site's security keys. When those keys change (after a break-in, or because a host or plugin does it on a schedule), the codes can no longer be checked. The plugin notices at the next visit to the sign-in page and writes to everybody with two-step sign-in, and the page that asks for the code says what happened. Settings \u2192 Hardening says for thirty days what was done and whether everybody could be reached. (If the site's address or its folder changed at the same time, as on a copy of the site, nobody is written to. The plugin keeps a mark of the place for this, not the address, so that a copy made by replacing the address throughout the database is still told from the site itself.) Sign in with a backup code, then set it up again or switch it off with another backup code: either takes two minutes. Backup codes are not affected by the change.<\/p>\n\n
If a host or a plugin changes the keys on a schedule, this happens every time. Ask them to stop, or two-step sign-in is not practical on that site.<\/p><\/dd>\n
Where is the security.txt file, and why can I not see it?<\/h3><\/dt>\nAt \/.well-known\/security.txt on your domain, which is where the standard puts it. It is served only when the site is on HTTPS and lives at the top of its domain, when a contact is set, and while its date is good. Some web servers refuse every address with \"\/.\" in it before WordPress is asked. The \"Check that visitors can read it\" button on the settings screen tells you, and your host can let that one address through. If a file of that name already lies on the server, it wins: the button tells you that too.<\/p><\/dd>\n
Why does the security.txt file run out?<\/h3><\/dt>\nThe standard requires a date, so that nobody reports a problem to an address that stopped being read years ago. A contact you give or change is good for 360 days. You get an email and a notice on Settings \u2192 Hardening 30 days before the end. Pressing Save on the settings screen then confirms the contact for another 360 days. If you do nothing, the file is taken down on that date and comes back the moment you press Save.<\/p><\/dd>\n
I am paused by the password-guess lockout on my own site.<\/h3><\/dt>\nWait until the time the sign-in page shows, or sign in from another network (a phone without Wi-Fi): only the address is paused, not your account. Or have your web host (or anyone with access to the server) do one of these:<\/p>\n\n
\n- run
wp doctorx-hardening unlock --all<\/code> (or unlock YOUR_ADDRESS<\/code>), or wp doctorx-hardening guard off<\/code><\/li>\n- add
define( 'DOCTORX_HARDENING_NO_LOCKOUT', true );<\/code> to wp-config.php, above \"That's all, stop editing\". Nobody is paused or counted while it is there, and Settings \u2192 Hardening reminds you to take it out.<\/li>\n<\/ul>\n\nAdd your office and home addresses to the trusted list so this cannot happen there.<\/p><\/dd>\n
My own address was banned by the probe ban.<\/h3><\/dt>\nSign in from another network (a phone without Wi-Fi) and lift the ban on Settings \u2192 Hardening \u2192 Sign-in and server, or run wp doctorx-hardening unban --all<\/code> (or wp doctorx-hardening unlock ADDRESS<\/code>, which lifts a sign-in pause and a ban of that address) on the server, or add define( 'DOCTORX_HARDENING_NO_PROBE_BAN', true );<\/code> to wp-config.php: nobody is banned or counted while it is there.<\/p><\/dd>\nI lost the address of the hidden sign-in door.<\/h3><\/dt>\nIt was emailed to the site's administration address when it was set. Otherwise run wp doctorx-hardening door<\/code> on the server to see it, wp doctorx-hardening door off<\/code> to switch the door off, or add define( 'DOCTORX_HARDENING_NO_DOOR', true );<\/code> to wp-config.php: wp-login.php answers again at once.<\/p><\/dd>\nWill any of this hurt my search ranking or AI assistants?<\/h3><\/dt>\nNo part of it changes what visitors, search engines or AI assistants read on your pages. The probe ban does not count a crawler. The Cloudflare rules leave every crawler Cloudflare verifies alone. The server lines do not name a crawler to turn away. \"Hide the WordPress version\" changes a few characters in the addresses of WordPress's own script files, nothing that is read.<\/p><\/dd>\n
What happens when I delete the plugin?<\/h3><\/dt>\nIts settings are removed (on a multisite network, on every site). So are the sign-in guard's settings, the paused and banned addresses and the sealed Cloudflare token. The rules already at Cloudflare stay there: remove them with Undo first if you want them gone. Everything kept for two-step sign-in on every account is removed too, and so is the activity record with its events. (Simple History's own tables, if you still have them, are left alone.) Signing in then takes only the password again. Deactivating without deleting keeps everything for when you switch it back on. While it is deactivated nobody is asked for a code, and when it is deactivated on the Plugins screen everybody who had two-step sign-in is told by email.<\/p><\/dd>\n
What does the activity record keep, and for how long?<\/h3><\/dt>\nEach event says what happened, when, who did it (a signed-in person, an anonymous visitor, WordPress itself, or WP-CLI), the address the request came from, the browser's name, and the details of what changed (a post's title before and after, a plugin's version before and after). Addresses are kept without their last part unless you choose to keep them whole. Events are removed after the number of days you choose (60 unless you change it), once a day, and the removal is itself recorded. Administrators read everything. Editors read the events about what they can change themselves. Addresses are shown to administrators only.<\/p><\/dd>\n
I used Simple History. Do I lose its log?<\/h3><\/dt>\nNo. Switch the activity record on, then press \"Bring in Simple History's events\" on Settings \u2192 Hardening (or run \"wp doctorx-hardening activity import\"). Every event comes over with its date, address, details and who did it. Pressing it again brings in only what is new. Simple History's own tables are not changed, so switching back is reactivating it. Code written for Simple History (\"do_action( 'simple_history_log', ... )\") keeps being recorded once Simple History is gone.<\/p><\/dd>\n
Can it tell me when something happens?<\/h3><\/dt>\nYes. On the activity record's \"More settings\" screen, add a destination: an email address, a Slack, Discord or Microsoft Teams webhook, a Telegram bot, or any webhook. Then add a rule. It can be a ready one (security, content, updates, failed sign-ins, plugins installed, somebody made an administrator) or your own (kinds of events, the lowest level, who did it, words). \"Alert me about events like these\" on the record makes a rule from what you searched. Each rule sends at most the number of alerts an hour you set, and a run of failed sign-ins alerts at the 1st, 10th, 100th attempt. Nothing is sent until you switch alerts on.<\/p><\/dd>\n
Can it send the record to our log service?<\/h3><\/dt>\nYes: syslog (this server's, or another over UDP, TCP or TLS), Datadog, Splunk or any webhook. Keys, tokens and passwords are kept sealed and are not shown again. Events are sent once the page has answered, at most 50 a request. What a request cannot send (more events, a destination that is down) waits, and is sent in order by a scheduled job that exists only while forwarding is on and something waits. At most 5,000 events wait for each destination. Past that the oldest are dropped, and the screen, wp doctorx-hardening activity forward list<\/code> and the activity record say how many. Events made by backfill are not forwarded. Events dated in the past by hand also wait their turn (at most 500 a destination).<\/p>\n\nDelivery is \"at least once\": after a failure half-way an event can arrive twice. So every event carries a delivery id that a receiver can use to drop repeats. It is the \"uid\": your site, the event's number and its count. Webhooks also get it in the X-DRX-Event-Id header. Destinations on this server itself or on link-local addresses (such as a cloud metadata service) are refused. A destination's name is looked up once and the connection goes to the address that was checked. A name that cannot be found is not sent to. TLS certificates are checked, for syslog over TLS and for the database with TLS, against the certificates WordPress trusts. Code can name your own CA file with the filter doctorx_hardening_activity_ca_file. A website set up not to send (the line define( 'DOCTORX_HARDENING_MAY_CONNECT', false );<\/code> in wp-config.php) sends no alert, forwards nothing and looks nothing up.<\/p><\/dd>\nDoes it look up where an address is?<\/h3><\/dt>\nOnly if you choose how. It can use a database file on your server (MaxMind GeoLite2, DB-IP Lite or IPinfo's .mmdb), and then nothing leaves the server. Or it can use ipinfo.io with your own token, and then only when an administrator opens an address (not on a website set up not to send). Out of the box nothing is looked up.<\/p><\/dd>\n
Does the activity record slow the site down?<\/h3><\/dt>\nNot for visitors: nothing of it runs on a page view. A failed sign-in costs one database write. A run of them from one address is counted on one line.<\/p><\/dd>\n
Privacy: what does it keep about people, and where does it go?<\/h3><\/dt>\n