Fixes a bug where hiding the WordPress version also removed the ?ver= cache-busting parameter from every script and style, which could leave browsers serving outdated files and break themes that load webpack chunks. Also fixes a bypass in the login attempt limiter and an issue where the custom login URL blocked anonymous admin-post.php requests. New installs now start with every option disabled; your current settings are preserved. Recommended for all users.<\/p>"},"ratings":{"1":0,"2":0,"3":0,"4":0,"5":1},"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3632190,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3632190,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256},"icon.svg":{"filename":"icon.svg","revision":3632190,"resolution":false,"location":"assets","locale":false}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3632190,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3632190,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0.9","1.1.0","1.1.1"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3632182,"resolution":"1","location":"assets","locale":"","width":879,"height":583}},"screenshots":{"1":"The settings screen. Every option is off by default and can be enabled individually, grouped by area: REST API, login, protocols, information disclosure, HTTP headers and WooCommerce."}},"plugin_section":[],"plugin_tags":[31093,602,23853,600,286],"plugin_category":[38,45,54],"plugin_contributors":[274273],"plugin_business_model":[],"class_list":["post-339689","plugin","type-plugin","status-publish","hentry","plugin_tags-hardening","plugin_tags-login","plugin_tags-rest-api","plugin_tags-security","plugin_tags-woocommerce","plugin_category-authentication","plugin_category-ecommerce","plugin_category-security-and-spam-protection","plugin_contributors-open24","plugin_committers-open24"],"banners":{"banner":"https:\/\/ps.w.org\/open24-security\/assets\/banner-772x250.png?rev=3632190","banner_2x":"https:\/\/ps.w.org\/open24-security\/assets\/banner-1544x500.png?rev=3632190","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":"https:\/\/ps.w.org\/open24-security\/assets\/icon.svg?rev=3632190","icon":"https:\/\/ps.w.org\/open24-security\/assets\/icon.svg?rev=3632190","icon_2x":false,"generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/open24-security\/assets\/screenshot-1.png?rev=3632182","caption":"The settings screen. Every option is off by default and can be enabled individually, grouped by area: REST API, login, protocols, information disclosure, HTTP headers and WooCommerce."}],"raw_content":"\n
Open24 Security applies a set of well-known hardening measures to WordPress and WooCommerce sites from a single settings screen. Every option is off by default and can be switched on individually, so you decide exactly how much you want to restrict.<\/p>\n\n
The plugin does not phone home, does not require an account and does not send any data to external services. The only outbound request it makes is to the official WordPress.org API, and only when you explicitly rotate your security keys.<\/p>\n\n
WordPress REST API<\/strong><\/p>\n\n Login<\/strong><\/p>\n\n Protocols<\/strong><\/p>\n\n Information disclosure<\/strong><\/p>\n\n HTTP security headers<\/strong><\/p>\n\n WooCommerce<\/strong><\/p>\n\n Tools<\/strong><\/p>\n\n Agency signature<\/strong><\/p>\n\n Rotating the WordPress security keys requires updating the corresponding constants in wp-config.php. The plugin does this through the official WP_Filesystem API, writes to a temporary file with restrictive permissions and then moves it over the original in a single atomic operation, preserving the original file permissions. No backup copy is left anywhere on the server, and if any step fails, wp-config.php is left untouched.<\/p>\n\n If wp-config.php is not writable, the feature reports it and makes no changes.<\/p>\n\n\n All options are disabled by default. Enable them one at a time and test your site after each change, especially the custom login URL and the REST API restrictions.<\/p>\n\n\n Every option is off by default. The ones that need the most care are the custom login URL and the REST API restrictions, because some themes and plugins rely on those endpoints. Enable them one at a time and check your site afterwards.<\/p><\/dd>\n Rename or delete the Yes. The WooCommerce options only appear when WooCommerce is active.<\/p><\/dd>\n No. The only outbound request is to the official WordPress.org key generator API, and only when you choose to log out all users.<\/p><\/dd>\n Under Login, set \"Visitor IP read from\" to the header your proxy sets. The screen shows the IP the plugin currently sees for you, so you can confirm the setting is right. Leave it on the direct connection unless there really is a proxy in front of the site: those headers are sent by the client, so trusting them without a proxy lets an attacker send a different IP on every login attempt and never get locked out.<\/p><\/dd>\n Because that is where WordPress stores the security keys and salts, as PHP constants. Changing them is what invalidates every session cookie. See the Description for details on how the file is written safely.<\/p><\/dd>\n\n<\/dl>\n\n\n\n
\n
\n
\n
\n
\n
\n
\n
About the security keys feature<\/h4>\n\n
\n
open24-security<\/code> folder to \/wp-content\/plugins\/<\/code>, or install the plugin through the WordPress plugins screen.<\/li>\n\n
Will this break my site?<\/h3><\/dt>\n
I enabled the custom login URL and now I am locked out. What do I do?<\/h3><\/dt>\n
open24-security<\/code> folder in \/wp-content\/plugins\/<\/code> over FTP or your hosting file manager. The plugin will be deactivated and wp-login.php will work again.<\/p><\/dd>\nDoes this plugin work without WooCommerce?<\/h3><\/dt>\n
Does the plugin send data anywhere?<\/h3><\/dt>\n
I am behind Cloudflare and every visitor looks like the same IP<\/h3><\/dt>\n
Why does logging out all users modify wp-config.php?<\/h3><\/dt>\n
1.1.1<\/h4>\n\n
\n
?ver=<\/code> parameter from script and style URLs. That parameter is how WordPress tells browsers and CDNs to fetch an asset again after it changes; removing it meant an updated theme or plugin could keep serving the old cached file indefinitely. On themes that load webpack chunks the result was a broken front end, because the chunks are requested outside wp_enqueue_script<\/code> and did arrive updated, leaving a stale bundle trying to resolve new module IDs. The option now only hides the generator meta tag and the version in feeds, which is what its name promises. No action is needed after updating: asset URLs go back to normal on their own.<\/li>\nCF-Connecting-IP<\/code> and X-Forwarded-For<\/code> headers whenever they were present, and those are sent by the client. On a site without a proxy in front, an attacker could send a different IP on every request and never reach the lockout threshold, or send someone else's IP to get them locked out. The IP is now read from the connection itself, and a new setting under Login lets you pick a proxy header when the site genuinely sits behind Cloudflare, a load balancer or an Nginx proxy. The settings screen shows the IP currently detected for you so you can verify the choice.<\/li>\nadmin-post.php<\/code> were redirected to the login slug. That endpoint lives in \/wp-admin\/<\/code> but is public by design: it dispatches the admin_post_nopriv_*<\/code> actions used by contact forms, payment gateway callbacks and other plugins. Those requests silently turned into a redirect. admin-post.php<\/code>, admin-ajax.php<\/code>, WP-Cron and WP-CLI are now excluded from the redirect.<\/li>\no24s_client_ip<\/code> filter for setups whose IP header is not one of the four offered.<\/li>\n<\/ul>\n\n1.1.0<\/h4>\n\n
\n
open24-security<\/code> text domain.<\/li>\n.pot<\/code> template in \/languages<\/code>.<\/li>\nDomain Path<\/code> header and loading of the bundled translations on init<\/code>.<\/li>\n<\/ul>\n\n1.0.9<\/h4>\n\n
\n
1.0.0<\/h4>\n\n
\n