Adds login attempt limits and security headers (both on after updating), server rules for Nginx and OpenLiteSpeed, a security audit and WP-CLI commands.<\/p>","1.2.1":"
Updates the plugin link. No functional changes.<\/p>","1.2.0":"
Fixes uploads protection on sites that already had an .htaccess file in uploads, and fully disables XML-RPC pingbacks. Recommended for all users.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3786847,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3786847,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3786847,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3786847,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.2.0","1.2.1","1.3.0"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3786840,"resolution":"1","location":"assets","locale":"","width":1280,"height":900},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3786840,"resolution":"2","location":"assets","locale":"","width":1280,"height":900}},"screenshots":{"1":"Protections grouped by area, with a meter that shows how many are on.","2":"The status check shows whether each protection is working."}},"plugin_section":[],"plugin_tags":[31093,9374,600,153786,6558],"plugin_category":[54],"plugin_contributors":[290976],"plugin_business_model":[],"class_list":["post-396515","plugin","type-plugin","status-publish","hentry","plugin_tags-hardening","plugin_tags-limit-login-attempts","plugin_tags-security","plugin_tags-security-headers","plugin_tags-xml-rpc","plugin_category-security-and-spam-protection","plugin_contributors-felipepitol","plugin_committers-felipepitol"],"banners":{"banner":"https:\/\/ps.w.org\/stoutwall\/assets\/banner-772x250.png?rev=3786847","banner_2x":"https:\/\/ps.w.org\/stoutwall\/assets\/banner-1544x500.png?rev=3786847","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/stoutwall\/assets\/icon-128x128.png?rev=3786847","icon_2x":"https:\/\/ps.w.org\/stoutwall\/assets\/icon-256x256.png?rev=3786847","generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/stoutwall\/assets\/screenshot-1.png?rev=3786840","caption":"Protections grouped by area, with a meter that shows how many are on."},{"src":"https:\/\/ps.w.org\/stoutwall\/assets\/screenshot-2.png?rev=3786840","caption":"The status check shows whether each protection is working."}],"raw_content":"\n
Stoutwall applies well-known hardening measures that most sites should have, each behind its own switch. There is no firewall, no scanner and no account to create: it changes how WordPress behaves, and you can see and undo every change. One small plugin instead of five single-purpose ones.<\/p>\n\n
What it can do<\/strong><\/p>\n\n Check that it really works<\/strong><\/p>\n\n Rules for your web server<\/strong><\/p>\n\n Stoutwall generates matching rules for Apache, LiteSpeed, OpenLiteSpeed and Nginx<\/strong>, so the protections also cover static files and servers that ignore For developers and agencies<\/strong><\/p>\n\n Privacy<\/strong><\/p>\n\n Stoutwall does not send anything to external servers, does not add cookies and does not send emails. To limit login attempts it keeps, on your own site, a hashed IP address of failed logins for 15 minutes and a partial IP address (such as 203.0.113.x) of locked-out visitors for up to a day.<\/p>\n\n Reporting security issues<\/strong><\/p>\n\n Please report vulnerabilities privately through the Wordfence<\/a> or Patchstack<\/a> programs, which coordinate the fix with the author before disclosure.<\/p>\n\n\n Most protections work on any server. Blocking PHP in uploads relies on Wait for the lockout to end, or run Your site is behind a proxy or CDN, so every visitor reaches WordPress with the same IP address. In the Limit login attempts<\/strong> row, open Advanced<\/strong> and choose the header your proxy sets, for example Cloudflare.<\/p><\/dd>\n Each measure can be turned off on its own. Things to know before enabling them:<\/p>\n\n Deactivating removes the plugin's rules from the uploads Install and activate Stoutwall. It imports your ProtectMyWordPress settings and replaces its \n
X-Content-Type-Options<\/code>, X-Frame-Options<\/code> and Referrer-Policy<\/code>, plus optional HSTS.<\/li>\nwp-content\/uploads\/.htaccess<\/code> that block PHP files, including .phtml<\/code>, .php5<\/code>, .phar<\/code> and double extensions such as image.php.jpg<\/code>. Rules from other plugins in the same file are kept.<\/li>\npingback.ping<\/code>, which is often abused for DDoS amplification, and removes the X-Pingback<\/code> header.<\/li>\n?author=N<\/code> lookups and hides usernames from the REST API for visitors, the users sitemap and oEmbed responses. Authors and editors keep the author list in the block editor.<\/li>\n\n
.htaccess<\/code> rules are present and the headers reach the browser, not only that the switch is on.<\/li>\nwp-config.php<\/code>, a public debug.log<\/code>, an \"admin\" user, open registration with a powerful role and more. It also tests from outside whether PHP files in uploads run and whether folders can be listed. The quick checks also appear in Tools \u2192 Site Health<\/strong>.<\/li>\n<\/ul>\n\n.htaccess<\/code>. You review and paste them; nothing outside the uploads folder is changed for you.<\/p>\n\n\n
wp stoutwall list|status|enable|disable|export|import|lockouts|unlock|allowlist|rules|audit<\/code>.<\/li>\nstoutwall_security_headers<\/code>, stoutwall_public_rest_namespaces<\/code>, stoutwall_login_max_failures<\/code> and stoutwall_client_ip<\/code>.<\/li>\n<\/ul>\n\n\n
stoutwall<\/code> folder to \/wp-content\/plugins\/<\/code>.<\/li>\n\n
Does it work on Nginx and OpenLiteSpeed?<\/h3><\/dt>\n
.htaccess<\/code>, which Apache and LiteSpeed Enterprise read but Nginx and OpenLiteSpeed ignore. Open Settings \u2192 Stoutwall \u2192 Server rules<\/strong>, pick your server and paste the rules it shows. Then run the audit: it tests whether PHP in uploads is really blocked.<\/p><\/dd>\nI locked myself out. How do I get back in?<\/h3><\/dt>\n
wp stoutwall unlock --all<\/code> with WP-CLI. To avoid it, add your office or VPN address under Settings \u2192 Stoutwall \u2192 Tools \u2192 Allowed IP addresses<\/strong>. Without WP-CLI, rename the wp-content\/plugins\/stoutwall<\/code> folder, log in, rename it back and unlock the IP in Settings \u2192 Stoutwall \u2192 Tools<\/strong>.<\/p><\/dd>\nEveryone gets locked out at the same time<\/h3><\/dt>\n
Will it break my site?<\/h3><\/dt>\n
\n
stoutwall_public_rest_namespaces<\/code> filter for others.<\/li>\nWhat happens when I deactivate or delete the plugin?<\/h3><\/dt>\n
.htaccess<\/code> (other rules stay) and every other measure stops applying. Deleting the plugin also removes its settings.<\/p><\/dd>\nI used ProtectMyWordPress from GitHub. How do I move to Stoutwall?<\/h3><\/dt>\n
.htaccess<\/code> rules. Then deactivate and delete ProtectMyWordPress.<\/p><\/dd>\n\n<\/dl>\n\n\n1.3.0<\/h4>\n\n
\n
1.2.1<\/h4>\n\n
\n
1.2.0<\/h4>\n\n
\n
.htaccess<\/code> rules from ProtectMyWordPress are migrated on activation.<\/li>\nuploads\/.htaccess<\/code> already exists. Before, an existing file meant no rules were added while the status still reported OK.<\/li>\n.phtml<\/code>, .php5<\/code>, .phar<\/code> and double extensions. They are removed on deactivation.<\/li>\nX-Pingback<\/code> header is removed.<\/li>\n?author=1,2<\/code>. The posts list filter in the dashboard and the block editor author list work again.<\/li>\n1.1<\/h4>\n\n
\n
1.0<\/h4>\n\n
\n