Title: HT Security
Author: WPFastSec
Published: <strong>24. април 2025.</strong>
Last modified: 10. август 2026.

---

Претражи додатке

![](https://ps.w.org/ht-security/assets/icon-256x256.png?rev=3281269)

# HT Security

 [WPFastSec](https://profiles.wordpress.org/wpfastsec/)

[Преузимање](https://downloads.wordpress.org/plugin/ht-security.1.7.1.zip)

 * [Детаљи](https://sr.wordpress.org/plugins/ht-security/#description)
 * [Прегледи](https://sr.wordpress.org/plugins/ht-security/#reviews)
 *  [Постављање](https://sr.wordpress.org/plugins/ht-security/#installation)
 * [Изградња](https://sr.wordpress.org/plugins/ht-security/#developers)

 [Подршка](https://wordpress.org/support/plugin/ht-security/)

## Опис

HT Security is a complete security suite for WordPress, offering multiple layers
of protection for your website.

**Important – External Service:**
 This plugin queries the National Vulnerability
Database (NVD) API to check for known CVE vulnerabilities. Requests are made to:*
API URL: https://services.nvd.nist.gov/rest/json/cves/2.0 * Terms of Use: https://
nvd.nist.gov/general/legal-disclaimer * Privacy Policy: https://www.nist.gov/privacy-
policy * Frequency: Automatic check every 12 hours or manual on-demand * Data sent:
Name and version of WordPress/installed plugins (no personal data is sent)

The NVD API query is essential for the plugin’s CVE vulnerability detection functionality.

#### Key Features

 * **Security Headers** – HSTS, X-Frame-Options, Content-Security-Policy, and more
 * **Login Alerts** – Email notifications for successful and failed login attempts
   with rate limiting
 * **Login Captcha** – Built-in SVG numeric captcha or Cloudflare Turnstile for 
   login, password reset, and registration forms
 * **Core Integrity Check** – Verify WordPress core files against official checksums
   with 24h cache
 * **CVE Vulnerability Detection** – Check WordPress Core and active plugins against
   NVD database
 * **User Enumeration Protection** – Block user enumeration via REST API and author
   parameters
 * **Maintenance Mode** – Maintenance mode with authorized IP whitelist (IPv4, IPv6,
   CIDR support)
 * **File Permissions Audit** – Audit and automatic correction of critical file 
   permissions
 * **Plugin Security Indicators** – Visual badges on plugins page showing vulnerability
   status
 * **Plugin Update Management** – Notify when plugins need updates; optionally auto-
   update only selected plugins
 * **Force Cron** – Secret HTTP ping to spawn WordPress cron when official wp-cron
   is unreliable

#### CVE Detection Features

 * Integration with NVD (National Vulnerability Database) API 2.0
 * Check WordPress Core and active plugins for known vulnerabilities
 * Intelligent batch processing with rate limiting
 * **8 layers of anti-false-positive validation**
 * Vulnerability badges on plugins page (enable/disable option)
 * Dismissible alerts per user
 * Email notification when vulnerabilities are detected
 * Automatic check every 12 hours
 * NVD API Key support (increased rate limit)

#### Security Improvements in v1.5.0

 * **IP Spoofing Fix** – Properly detects real IP behind Cloudflare, proxies, and
   load balancers
 * **Capability Check Fix** – Authorization verified before processing
 * **Rate Limiting by IP** – More granular rate limiting for login alerts
 * **Input Validation** – Maximum length validation for feedback form

### Supported Languages

 * English (US) – 100%
 * English (UK) – 100%
 * Português do Brasil – 100%
 * Português de Portugal – 100%
 * Español – 100%

### License

This plugin is licensed under the GNU General Public License v2.0 or later. For 
more information, visit https://www.gnu.org/licenses/gpl-2.0.html.

## Снимци екрана

[⌊Plugin settings page with all security options⌉⌊Plugin settings page with all 
security options⌉[

Plugin settings page with all security options

[⌊CVE vulnerability check results⌉⌊CVE vulnerability check results⌉[

CVE vulnerability check results

## Постављање

 1. Upload the `ht-security` folder to the `/wp-content/plugins/` directory
 2. Activate the plugin through the ‘Plugins’ menu in WordPress
 3. Go to ‘Settings > HT Security’ to configure

## ЧПП

### When does the plugin send emails?

Successful logins, failed logins, CVE vulnerabilities (if enabled), vulnerable WordPress
version alerts (if enabled), and available plugin updates (if Plugin Update Management
is enabled).

### Can I disable the security headers?

Yes, through the settings page.

### Does the plugin check WordPress Core integrity?

Yes, since version 1.1.0 we added this functionality to provide clear security visibility
for administrators.

### How does CVE vulnerability detection work?

The plugin queries the NVD (National Vulnerability Database) to check for known 
vulnerabilities in WordPress Core and active plugins. The check runs automatically
every 12 hours and can also be run manually.

### Do I need an NVD API Key?

It’s not required, but recommended. Without an API Key, the rate limit is 5 requests
per 30 seconds. With a free API Key, it increases to 50 requests per 30 seconds,
making checks much faster.

### Can vulnerability badges be disabled?

Yes! In HT Security settings there’s an option to disable badges on the plugins 
page. The top alert will continue to work.

### How do dismissible alerts work?

You can close alerts on the plugins page by clicking the X. They won’t reappear 
until the next vulnerability check. The dismissed state is saved per user.

### How does user enumeration blocking work?

The plugin blocks attempts to list users through the REST API and redirects via 
author parameters.

### How do I enable the login captcha?

Go to Settings > HT Security > Login Captcha, enable it and choose SVG (built-in)
or Cloudflare Turnstile (requires free keys from https://dash.cloudflare.com  Turnstile).
The captcha applies to the login, password reset and registration forms.

### Does the SVG captcha send data anywhere?

No. The SVG captcha is generated entirely on your server and never makes external
requests. The Cloudflare Turnstile option loads the official Turnstile script from
challenges.cloudflare.com and verifies the token via Cloudflare’s siteverify API.

### Does maintenance mode affect administrators?

No, logged-in administrators can continue accessing the site normally.

### Does automatic permission correction always work?

It depends on server settings. In some cases, manual correction via FTP/SSH may 
be necessary.

### Does the anti-false-positive system work well?

Yes! We implemented **8 layers of validation**: name validation, version validation,
generic term filtering, addon detection, license variant detection, word matching,
word count ratio, and more. This eliminates over 99% of false positives.

### Will new features be added?

Yes, we’re constantly improving the plugin with new features and security enhancements.

## Прегледи

![](https://secure.gravatar.com/avatar/0962dc971c5530d30033469eaf3be28f8d76ed8af8d3e56fdf3b4f83e851e112?
s=60&d=retro&r=g)

### 󠀁[Perfect Plugin Security](https://wordpress.org/support/topic/perfect-plugin-security/)󠁿

 [Lucas Catão Moraes](https://profiles.wordpress.org/dolutech/) 9. мај 2025.

A quality security plugin! I recommend it

 [ Види сав 1 преглед ](https://wordpress.org/support/plugin/ht-security/reviews/)

## Сарадници и градитељи

„HT Security“ је софтвер отвореног кода. Следећи људи су допринели овом додатку.

Сарадници

 *   [ WPFastSec ](https://profiles.wordpress.org/wpfastsec/)

[Преведите „HT Security“ на свој језик.](https://translate.wordpress.org/projects/wp-plugins/ht-security)

### Заинтересовани сте за градњу?

[Прегледајте код](https://plugins.trac.wordpress.org/browser/ht-security/), проверите
[SVN складиште](https://plugins.svn.wordpress.org/ht-security/) или се пријавите
на [белешку градње](https://plugins.trac.wordpress.org/log/ht-security/) преко [RSS-а](https://plugins.trac.wordpress.org/log/ht-security/?limit=100&mode=stop_on_copy&format=rss).

## Белешка о изменама

#### 1.7.0

 * **NEW: Login Captcha**
    - Protect wp-login.php forms (login, password reset, registration) with a captcha
    - SVG numeric captcha (built-in, no external requests, works offline), with 
      per-IP rate limiting
    - Cloudflare Turnstile option (managed challenge) when site/secret keys are 
      configured
    - Fail-closed: if Turnstile is selected without keys, logins are blocked (no
      silent downgrade to SVG)
    - Captcha skipped for XML-RPC, REST API and WP-CLI (form logins only)
    - Admin preview button (AJAX) to test the captcha without leaving the settings
      page
 * **Maintenance: DolutechAI added as contributor**
    - Development ecosystem now includes DolutechAI alongside WPFastSec
 * **Security: IP Spoofing Fix (CWE-290)**
    - Proxy headers (X-Forwarded-For, CF_CONNECTING_IP, X-Real-IP) are now only 
      trusted when the immediate peer is a configured trusted proxy
    - New „Trusted Proxy IPs“ setting with Cloudflare ranges reference
    - Removed HTTP_CLIENT_IP trust; X-Forwarded-For now uses the last hop (real 
      client)
 * **Security: Force Cron hardening**
    - Ping secret now uses a URL-safe charset; fallback query URL works correctly
    - Token validated with strict regex (alphanumeric, 32 chars)
 * **Security: Maintenance mode fixes**
    - wp-login.php is no longer blocked by maintenance mode (exact path comparison)
    - CIDR masks validated per address family (IPv4 <= 32, IPv6 <= 128); /0 rejected
 * **Security: User enumeration**
    - Also blocks ?author=slug and author_name parameters (previously only numeric)
 * **Fix: NVD keyword search double-encoding**
    - keywordSearch was URL-encoded twice, causing silent „no vulnerabilities“ results
 * **Fix: CVE check reliability**
    - Overlap lock prevents concurrent scheduled/manual checks
    - Time cap enforced inside each batch; results only overwritten on completed
      checks
    - Progress stored as transient; cron scheduled only when CVE alerts are enabled
 * **Fix: Emails**
    - Plain-text emails no longer contain HTML entities (esc_html removed)
    - Site name sanitized in email subjects and From headers (header injection hardening)
 * **Cleanup: uninstall.php**
    - Removes all plugin options, transients, user meta, and cron events on uninstall
 * **Compatibility:** Tested up to WordPress 7.0

#### 1.7.1

 * **Improved: SVG captcha usability**
    - Captcha banner now rotates as a whole (plus per-character rotation) to stay
      human-readable while resisting OCR
    - Redesigned SVG: gradient background, rounded corners, line and dot noise
    - New refresh button to generate a new code without reloading the page (per-
      IP rate limited, validates the existing challenge)
 * **Fix: Captcha refresh button not working**
    - Script is now printed on the login footer (the login page never calls wp_footer(),
      so footer-enqueued scripts were never loaded)
    - Refresh request switched from multipart FormData to URL-encoded, which some
      WAFs/firewalls block on admin-ajax.php
 * **Compliance: WordPress Plugin Check**
    - Escaped Turnstile site key output; sanitized cron ping token inputs
    - Renamed auto-update allowlist option to `htsec_autoupdate_plugins` with automatic
      migration of the legacy value
    - Aligned „Tested up to“ between plugin header and readme (7.0); author header
      now reads WPFastSec / DolutechAI
    - Nonce and resource-version phpcs ignores placed on the exact flagged lines

#### 1.6.1

 * **Security: Force Cron ping**
    - Prefer `X-HTSEC-Cron-Token` header; query-string token kept as fallback
    - UI documents header-based curl and HTTPS; warns about access-log leakage
 * **Security: Secret reveal**
    - Replaced GET reveal link with POST + nonce and one-shot per-user transient(
      60s)
 * **Security: Plugin updates**
    - Sanitize plugin names/versions in update alert emails
    - Overlap lock (10 minutes) to prevent concurrent update checks
    - Inline notice explaining HT Security controls native auto-updates when enabled

#### 1.6.0

 * **NEW: Plugin Update Management**
    - Enable/disable scheduled plugin update checks (twice daily)
    - Modes: Notify only, or Notify and auto-update selected plugins
    - Per-plugin allowlist for automatic updates
    - Email alerts via existing alert email setting (with deduplication)
    - Manual „Check for plugin updates now“ action
    - Uses WordPress native `autoupdate` filter and `wp_maybe_auto_update()`
    - Respects DISALLOW_FILE_MODS / automatic updater file-mod policy
 * **NEW: Force Cron**
    - Toggle to enable a secret HTTP ping endpoint that calls `spawn_cron()`
    - Cron health status UI (DISABLE_WP_CRON, last ping, last spawn, overdue events)
    - Regenerable ping secret; rate-limited ping handler
    - Soft assist spawn on admin when Force Cron is enabled
 * **Improved: Internationalization**
    - Source strings converted to English (WordPress.org convention)
    - Regenerated POT/PO/MO for pt_BR, pt_PT, es_ES, en_GB
    - Removed redundant en_US catalog (English is the source language)
 * **Security**
    - Capability check added to manual CVE check POST handler
    - Centralized activation/deactivation cron cleanup for CVE and plugin-update
      events

#### 1.5.0

 * **NEW: CSP Custom Module (Advanced)**
    - Custom Content-Security-Policy configuration
    - 4 preset modes: Strict, Moderate, WordPress Optimized, Custom
    - Report-Only mode for testing without blocking
    - Disabled by default to avoid breaking existing sites
    - Custom directives for all CSP directives (default-src, script-src, etc.)
 * **NEW: WordPress Version Vulnerability Check**
    - Automatic detection of vulnerable WordPress versions
    - Visual alert on plugin settings page with severity breakdown
    - Email notification when vulnerable version detected (enabled by default)
    - Direct link to update WordPress
    - Checks enabled by default
 * **CRITICAL Security Fix: IP Spoofing Vulnerability (CWE-290)**
    - Added `htsec_get_user_ip()` function to detect real IP behind Cloudflare, 
      proxies, and load balancers
    - Support for CF_CONNECTING_IP, X-Forwarded-For, X-Real-IP headers with fallback
 * **CRITICAL Security Fix: Capability Check Order (CWE-862)**
    - Permission verification now occurs BEFORE processing in file permissions module
 * **Improved: Rate Limiting by IP**
    - Login alerts rate limiting is now per-IP for better granularity
 * **Added: Input Length Validation**
    - Maximum 5000 characters validation for feedback form
 * **Fixed: Deprecated Function**
    - Replaced `current_time('timestamp')` with `time()` (deprecated since WP 5.3)
 * **Added: API Response Validation**
    - Validate NVD API response before processing
 * **Added: AJAX Capability Check**
    - Added capability check in plugin indicators AJAX handler
 * **Improved: Internationalization**
    - 153 strings translated in 5 languages (pt_BR, pt_PT, en_US, en_GB, es_ES)
    - All .mo files compiled
 * **Removed: Legacy Code**
    - Removed `ht-security-antigo` folder
 * **Updated: WordPress Compatibility**
    - Tested up to WordPress 6.9.4

#### 1.4.0

 * **Added: Complete CVE Check Module**
    - Integration with NVD API 2.0
    - Check WordPress Core and active plugins
    - Batch processing with rate limiting
 * **Added: Internationalization (i18n)**
    - Support for pt_BR, pt_PT, en_US, en_GB, es_ES
 * **Added: IP Validation with CIDR Support**
    - IPv4, IPv6, and CIDR notation support in Maintenance Mode
 * **Added: Rate Limiting for Login Alerts**
    - 1 email per 5 minutes per type per IP
 * **Added: Core Check Cache**
    - 24h transient cache with manual refresh button
 * **Improved: Documentation**
    - Complete documentation in /docs directory

#### 1.3.3

 * **CRITICAL Improvement: License Variant Detection**
    - Fixed: FREE plugins no longer report PRO vulnerabilities
    - Detection of variants with parentheses: „Plugin (PRO)“, „Plugin (Premium)“
    - Detection of variants with brackets: „Plugin [PRO]“, „Plugin [Lite]“
    - Correct blocking when CVE mentions variant but plugin doesn’t have it
 * **Complete Code Refactoring**
    - Code modularized in 9 files by functionality
    - Organization in /includes/ directory following WordPress standards
    - Better separation of concerns
    - PHPDoc documentation in all modules

#### 1.3.2

 * **CVE Check Accuracy Fix**
    - Security badges now come DISABLED by default
    - User needs to enable manually in Settings > HT Security

#### 1.3.1

 * **New Feature: Feedback System**
    - Integrated feedback form on settings page
    - Direct submission to support@wpfastsec.com
 * **CRITICAL Fix: Improved Anti-False-Positive System**
    - 8 Validation Filters implemented
    - Eliminated false positives like AMP vs Ampache, Elementor Pro vs Essential
      Addons
    - 99.9% accuracy in real CVE detection

#### 1.3.0

 * **Main Feature: CVE Vulnerability Detection System**
    - Complete integration with NVD API 2.0
    - Automatic check every 12 hours
    - Severity badges (CRITICAL, HIGH, MEDIUM, LOW)
 * **Intelligent Batch Processing**
    - Rate limiting: 5 requests/30s without API Key
    - Rate limiting: 50 requests/30s with NVD API Key
 * **Anti-False-Positive System (4 Layers)**
    - Software name validation
    - Version validation
    - Generic term filtering
    - Addon/extension detection

#### 1.2.0

 * User enumeration blocking via REST API and author parameters
 * Maintenance mode with authorized IP whitelist
 * File permissions audit with automatic correction

#### 1.1.1

 * HSTS correction patch

#### 1.1.0

 * WordPress Core verification for site administrators

#### 1.0.0

 * First stable release with main features:
    - Security headers (HSTS, X-Frame-Options, CSP)
    - Login alert system with email notifications
    - Simple settings page

## Мета

 *  Version **1.7.1**
 *  Last updated **1 дан раније**
 *  Active installations **100+**
 *  WordPress version ** 6.5 или новије **
 *  Tested up to **7.0.3**
 *  PHP version ** 8.2 или новије **
 *  Language
 * [English (US)](https://wordpress.org/plugins/ht-security/)
 * Tags
 * [cve](https://sr.wordpress.org/plugins/tags/cve/)[headers](https://sr.wordpress.org/plugins/tags/headers/)
   [maintenance](https://sr.wordpress.org/plugins/tags/maintenance/)[security](https://sr.wordpress.org/plugins/tags/security/)
   [vulnerabilities](https://sr.wordpress.org/plugins/tags/vulnerabilities/)
 *  [Напредни преглед](https://sr.wordpress.org/plugins/ht-security/advanced/)

## Оцене

 5 out of 5 stars.

 *  [  1 5-star review     ](https://wordpress.org/support/plugin/ht-security/reviews/?filter=5)
 *  [  0 4-star reviews     ](https://wordpress.org/support/plugin/ht-security/reviews/?filter=4)
 *  [  0 3-star reviews     ](https://wordpress.org/support/plugin/ht-security/reviews/?filter=3)
 *  [  0 2-star reviews     ](https://wordpress.org/support/plugin/ht-security/reviews/?filter=2)
 *  [  0 1-star reviews     ](https://wordpress.org/support/plugin/ht-security/reviews/?filter=1)

[Your review](https://wordpress.org/support/plugin/ht-security/reviews/#new-post)

[See all reviews](https://wordpress.org/support/plugin/ht-security/reviews/)

## Сарадници

 *   [ WPFastSec ](https://profiles.wordpress.org/wpfastsec/)

## Подршка

Имате нешто да кажете? Потребна вам је помоћ?

 [Види форум подршке](https://wordpress.org/support/plugin/ht-security/)