Description
YuraCode Security makes your site safer as soon as you activate it. Nothing to configure: every protection is already on with safe, recommended settings. There are no external calls and no dashboard to manage. Review or adjust anything on the Settings YuraCode Security screen.
It protects your site in three ways: hardening, login protection, and a firewall.
Hardening
- Hides your site’s version – attackers scan for known bugs in WordPress, so showing your version makes you an easier target.
- Closes a little-used door that attackers abuse.
- Locks down the file editor – stops plugins and themes being edited from the admin, so a hacked admin account can’t plant backdoors.
- Generic login errors – the same message for any wrong password, so attackers can’t confirm a username.
- Removes the extra code WordPress loads for emojis – trims a little weight from every page.
- Stops your site pinging itself – no more self-pings when you link to your own posts.
- Blocks an extra way for external tools to get into your site.
- Stops WordPress and plugins from running AI prompts on your site.
- Disable comments – ends comment spam and hides existing comments. Off by default because blogs use comments; turn it on if your site doesn’t (most don’t).
Login Protection
- Stops attackers hammering your login form with password guesses. After too many failed attempts from the same address, that address is locked out for a while (5 attempts by default, for 15 minutes). Both are adjustable.
Firewall
A firewall that watches every visit before your site even loads and rejects the requests that don’t look right. Your sensitive files are protected from being downloaded, and uploaded files can’t run code on your server.
- Blocks known attack patterns – malicious requests and suspicious visitors are rejected at the door.
- Protects your sensitive files – your site’s configuration and backup files can’t be downloaded.
- Blocks dangerous uploads – files uploaded to your site can’t run code.
Privacy
YuraCode Security makes no external requests and collects no user data. It runs entirely on your server. The only files it writes are its own settings and the firewall rules it manages, with a backup of your original file kept in the uploads folder. Nothing is sent anywhere.
Credits
The built-in firewall ruleset is the 8G Firewall by Jeff Starr (Perishable Press), bundled under the GPL.
Screenshots
Installation
- Install and activate the plugin from your site’s Plugins screen, or directly from the WordPress plugin directory.
- Done. The recommended protections are already on.
- Optional: review the settings on the Settings YuraCode Security screen.
FAQ
-
Do I need to configure anything?
-
No. Every protection is already turned on with safe, recommended settings. You can review or adjust them on the Settings YuraCode Security screen.
-
Does YuraCode Security work on nginx?
-
The hardening and login-protection features work on every server. The firewall works by writing rules to the
.htaccessfile, which only Apache (and LiteSpeed) honor. On nginx, IIS, or other servers it is detected automatically and skipped, with an admin notice explaining why. -
Does YuraCode Security make external requests?
-
No. The plugin runs entirely on your server, makes no external calls, and does not collect or send any data.
-
What happens to my .htaccess on deactivation?
-
The firewall’s rules are removed and your original file is restored. A backup of your original
.htaccessis kept in the uploads folder before every change and removed on uninstall. -
What exactly does it do technically?
-
For the technically minded: it turns off XML-RPC, the theme/plugin file editor, application passwords, AI prompts, emojis, and self-pingbacks; hides the WordPress version and asset version strings; and makes login error messages generic. Login protection locks out an IP address after too many failed attempts (5 by default, for 15 minutes). The firewall is the 8G ruleset by Perishable Press, written into the root
.htaccess(and the uploads folder), blocking malicious query strings, request URIs, user agents, referrers, and cookies; protectingwp-config.phpand other sensitive files; and denying PHP execution in the uploads folder.
Reviews
There are no reviews for this plugin.
Contributors & Developers
“YuraCode Security” is open source software. The following people have contributed to this plugin.
Contributors
Translate “YuraCode Security” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
1.0.1
- New: Turn off the built-in theme and plugin file editor.
- Fixed: the firewall no longer gets in the way on local development sites (localhost/loopback).
1.0.0
- Initial release.