Description
Open24 Security applies a set of well-known hardening measures to WordPress and WooCommerce sites from a single settings screen. Every option is off by default and can be switched on individually, so you decide exactly how much you want to restrict.
The plugin does not phone home, does not require an account and does not send any data to external services. The only outbound request it makes is to the official WordPress.org API, and only when you explicitly rotate your security keys.
Features
WordPress REST API
- Hide the /wp-json/wp/v2/users endpoint
- Require authentication on sensitive endpoints
- Disable the /wp-json/ index
Login
- Custom login URL (replace wp-login.php with your own slug)
- Limit login attempts per IP address
- Block common usernames such as admin or root
- Hide error hints that reveal whether a username exists
Protocols
- Disable XML-RPC
- Block external access to wp-cron.php
- Block user enumeration via ?author=N
Information disclosure
- Hide the WordPress version from the generator meta tag and RSS feeds
HTTP security headers
- X-Frame-Options, X-Content-Type-Options, Referrer-Policy
- Permissions-Policy, X-XSS-Protection
- Optional HSTS
WooCommerce
- Reject anonymous requests to the /wc/v3/ and /wc/v2/ REST routes
- Hide WooCommerce headers on the storefront
Tools
- Log out all users: rotates the WordPress security keys and salts, which invalidates every session cookie and immediately signs out all logged-in users. Useful after a suspected compromise or when an employee leaves.
- Change log: records which settings were changed and when.
Agency signature
- Adds an Open24 signature in the document head so the site can be identified as maintained by the agency by crawlers such as BuiltWith. This can be turned off.
About the security keys feature
Rotating the WordPress security keys requires updating the corresponding constants in wp-config.php. The plugin does this through the official WP_Filesystem API, writes to a temporary file with restrictive permissions and then moves it over the original in a single atomic operation, preserving the original file permissions. No backup copy is left anywhere on the server, and if any step fails, wp-config.php is left untouched.
If wp-config.php is not writable, the feature reports it and makes no changes.
Screenshots
Installation
- Upload the
open24-securityfolder to/wp-content/plugins/, or install the plugin through the WordPress plugins screen. - Activate the plugin through the Plugins menu in WordPress.
- Go to the “Open24 Security” menu to enable the options you need.
All options are disabled by default. Enable them one at a time and test your site after each change, especially the custom login URL and the REST API restrictions.
FAQ
-
Will this break my site?
-
Every option is off by default. The ones that need the most care are the custom login URL and the REST API restrictions, because some themes and plugins rely on those endpoints. Enable them one at a time and check your site afterwards.
-
I enabled the custom login URL and now I am locked out. What do I do?
-
Rename or delete the
open24-securityfolder in/wp-content/plugins/over FTP or your hosting file manager. The plugin will be deactivated and wp-login.php will work again. -
Does this plugin work without WooCommerce?
-
Yes. The WooCommerce options only appear when WooCommerce is active.
-
Does the plugin send data anywhere?
-
No. The only outbound request is to the official WordPress.org key generator API, and only when you choose to log out all users.
-
I am behind Cloudflare and every visitor looks like the same IP
-
Under Login, set “Visitor IP read from” to the header your proxy sets. The screen shows the IP the plugin currently sees for you, so you can confirm the setting is right. Leave it on the direct connection unless there really is a proxy in front of the site: those headers are sent by the client, so trusting them without a proxy lets an attacker send a different IP on every login attempt and never get locked out.
-
Why does logging out all users modify wp-config.php?
-
Because that is where WordPress stores the security keys and salts, as PHP constants. Changing them is what invalidates every session cookie. See the Description for details on how the file is written safely.
Reviews
Contributors & Developers
“Open24 Security” is open source software. The following people have contributed to this plugin.
Contributors
Translate “Open24 Security” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
1.1.1
- Fixed: “Hide the WordPress version” no longer strips the
?ver=parameter from script and style URLs. That parameter is how WordPress tells browsers and CDNs to fetch an asset again after it changes; removing it meant an updated theme or plugin could keep serving the old cached file indefinitely. On themes that load webpack chunks the result was a broken front end, because the chunks are requested outsidewp_enqueue_scriptand did arrive updated, leaving a stale bundle trying to resolve new module IDs. The option now only hides the generator meta tag and the version in feeds, which is what its name promises. No action is needed after updating: asset URLs go back to normal on their own. - Fixed: the login attempt limiter could be bypassed. The visitor IP was taken from the
CF-Connecting-IPandX-Forwarded-Forheaders whenever they were present, and those are sent by the client. On a site without a proxy in front, an attacker could send a different IP on every request and never reach the lockout threshold, or send someone else’s IP to get them locked out. The IP is now read from the connection itself, and a new setting under Login lets you pick a proxy header when the site genuinely sits behind Cloudflare, a load balancer or an Nginx proxy. The settings screen shows the IP currently detected for you so you can verify the choice. - Fixed: with the custom login URL enabled, anonymous requests to
admin-post.phpwere redirected to the login slug. That endpoint lives in/wp-admin/but is public by design: it dispatches theadmin_post_nopriv_*actions used by contact forms, payment gateway callbacks and other plugins. Those requests silently turned into a redirect.admin-post.php,admin-ajax.php, WP-Cron and WP-CLI are now excluded from the redirect. - Changed: every option now starts disabled on a new install. Until 1.1.0 a group of them was enabled out of the box, which meant activating the plugin changed how the site behaved before anyone had chosen anything, and made those changes hard to trace when something broke. Existing sites keep exactly the settings they had, including sites that never opened the settings screen.
- Added the
o24s_client_ipfilter for setups whose IP header is not one of the four offered.
1.1.0
- The plugin is now fully translatable. Every user-facing string goes through the WordPress i18n functions with the
open24-securitytext domain. - Source strings are now in English, so the plugin can be translated on translate.wordpress.org.
- Added a complete Spanish (es_ES) translation, plus the
.pottemplate in/languages. - Added the
Domain Pathheader and loading of the bundled translations oninit.
1.0.9
- Security keys are now written through the WP_Filesystem API instead of direct file writes.
- Removed the wp-config.php backup file that was left in the site root. It is no longer created.
- File permissions of wp-config.php are now preserved when rotating keys.
- All admin styles are now properly enqueued instead of being printed inline.
- Hardened input handling: all superglobals are unslashed and sanitized.
- All output is now escaped at the point of output.
- Internal redirects now use wp_safe_redirect().
- Readme and plugin headers translated to English.
1.0.0
- Initial release.