{"id":305847,"date":"2026-05-21T02:16:58","date_gmt":"2026-05-21T02:16:58","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/seguridad-basica-jr\/"},"modified":"2026-05-21T02:15:49","modified_gmt":"2026-05-21T02:15:49","slug":"jr-security-hardening-login-protection","status":"publish","type":"plugin","link":"https:\/\/sr.wordpress.org\/plugins\/jr-security-hardening-login-protection\/","author":23489675,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"1.0.0","stable_tag":"1.0.0","tested":"6.9.5","requires":"5.0","requires_php":"7.4","requires_plugins":null,"header_name":"JR Security Hardening and Login Protection","header_author":"Jhon Reina","header_description":"Application-level WordPress hardening: security headers, user enumeration blocking, login rate limiting with IP lockout, IP whitelist, event logging and server-level blocking recommendations.","assets_banners_color":"","last_updated":"2026-05-21 02:15:49","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"","header_author_uri":"https:\/\/jhonreina.com","rating":0,"author_block_rating":0,"active_installs":10,"downloads":121,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"1.0.0":{"tag":"1.0.0","author":"reinajhon46","date":"2026-05-21 02:15:49"}},"upgrade_notice":{"1.0.0":"<p>First release available on WordPress.org.<\/p>"},"ratings":[],"assets_icons":[],"assets_banners":[],"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0.0"],"block_files":[],"assets_screenshots":[],"screenshots":[]},"plugin_section":[],"plugin_tags":[31093,15756,600],"plugin_category":[54],"plugin_contributors":[263769],"plugin_business_model":[],"class_list":["post-305847","plugin","type-plugin","status-publish","hentry","plugin_tags-hardening","plugin_tags-login-protection","plugin_tags-security","plugin_category-security-and-spam-protection","plugin_contributors-reinajhon46","plugin_committers-reinajhon46"],"banners":[],"icons":{"svg":false,"icon":"https:\/\/s.w.org\/plugins\/geopattern-icon\/jr-security-hardening-login-protection.svg","icon_2x":false,"generated":true},"screenshots":[],"raw_content":"<!--section=description-->\n<p>JR Security Hardening and Login Protection secures your WordPress installation at the application level with one-click hardening modules. Designed to be secure by default and Cloudflare compatible.<\/p>\n\n<p><strong>Included modules:<\/strong><\/p>\n\n<ul>\n<li><strong>Disable XML-RPC<\/strong> \u2014 Full block (filter + hard block) to prevent brute force attacks and pingback DDoS.<\/li>\n<li><strong>Hide WordPress version<\/strong> \u2014 Removes version from generator meta and CSS\/JS assets.<\/li>\n<li><strong>Disable file editor<\/strong> \u2014 Prevents theme and plugin editing from the admin panel (DISALLOW_FILE_EDIT).<\/li>\n<li><strong>Disable emojis<\/strong> \u2014 Removes WordPress emoji scripts and styles, improving performance.<\/li>\n<li><strong>Block user enumeration (?author= and \/author\/)<\/strong> \u2014 Dual-layer protection against username discovery.<\/li>\n<li><strong>Block REST enumeration (wp-json users)<\/strong> \u2014 Prevents enumeration via the WordPress REST API.<\/li>\n<li><strong>Block sensitive paths\/files<\/strong> \u2014 Blocks access to readme.html, license.txt, .env, .git, composer.json, etc. (only what passes through WordPress).<\/li>\n<li><strong>Security headers<\/strong> \u2014 X-Content-Type-Options, Referrer-Policy, Permissions-Policy, X-Frame-Options, HSTS (HTTPS only) and removal of technology-revealing headers.<\/li>\n<li><strong>Login protection<\/strong> \u2014 Rate limiting by IP and by user+IP with configurable temporary lockout.<\/li>\n<li><strong>IP whitelist<\/strong> \u2014 Excludes trusted IPs from rate limiting to avoid accidental lockouts.<\/li>\n<li><strong>Email notification<\/strong> \u2014 Receive an email when an IP is locked out due to too many failed login attempts.<\/li>\n<li><strong>Activity log<\/strong> \u2014 Security event logging in a dedicated database table with configurable retention and automatic cleanup via cron.<\/li>\n<li><strong>Ready-to-use server rules<\/strong> \u2014 Code for Apache (.htaccess) and Nginx to block static files that WordPress cannot reach.<\/li>\n<\/ul>\n\n<p><strong>Smart IP detection:<\/strong><\/p>\n\n<ul>\n<li>Native support for Cloudflare (CF-Connecting-IP).<\/li>\n<li>Option to trust X-Forwarded-For \/ X-Real-IP behind trusted proxies.<\/li>\n<li>Fallback to REMOTE_ADDR.<\/li>\n<\/ul>\n\n<p><strong>Clean uninstall:<\/strong><\/p>\n\n<p>When the plugin is deleted, all options, the events table and transients are removed. No data is left behind in your database.<\/p>\n\n<!--section=installation-->\n<ol>\n<li>Upload the <code>jr-security-hardening-login-protection<\/code> folder to <code>\/wp-content\/plugins\/<\/code>.<\/li>\n<li>Activate the plugin from the WordPress \"Plugins\" menu.<\/li>\n<li>Go to <strong>Settings \u2192 JR Security<\/strong> and configure the modules.<\/li>\n<li>For full static file protection, apply the server rules shown in the \"Server\" tab.<\/li>\n<\/ol>\n\n<!--section=faq-->\n<dl>\n<dt id=\"does%20this%20plugin%20replace%20a%20server-level%20firewall%3F\"><h3>Does this plugin replace a server-level firewall?<\/h3><\/dt>\n<dd><p>No. This plugin protects what goes through WordPress. For static files like \/readme.html, you need server-level rules (Apache\/Nginx). The plugin includes those rules ready to copy and paste in the \"Server\" tab.<\/p><\/dd>\n<dt id=\"does%20it%20work%20with%20cloudflare%3F\"><h3>Does it work with Cloudflare?<\/h3><\/dt>\n<dd><p>Yes. It automatically detects the visitor's real IP via CF-Connecting-IP. If you use another proxy, you can enable \"Trust proxy headers\" in the settings.<\/p><\/dd>\n<dt id=\"what%20if%20i%20lock%20myself%20out%3F\"><h3>What if I lock myself out?<\/h3><\/dt>\n<dd><p>Lockouts use WordPress transients and expire automatically based on the configured hours. You can also add your IP to the whitelist from settings, or temporarily deactivate the plugin via FTP\/SSH by renaming the folder.<\/p><\/dd>\n<dt id=\"can%20i%20use%20this%20plugin%20with%20other%20security%20plugins%3F\"><h3>Can I use this plugin with other security plugins?<\/h3><\/dt>\n<dd><p>Yes, but avoid duplicating functionality. If another plugin already disables XML-RPC or adds headers, disable those modules here to avoid conflicts.<\/p><\/dd>\n<dt id=\"are%20settings%20lost%20when%20deactivating%20the%20plugin%3F\"><h3>Are settings lost when deactivating the plugin?<\/h3><\/dt>\n<dd><p>No. Settings are preserved when deactivating. They are only deleted when <strong>uninstalling<\/strong> the plugin completely.<\/p><\/dd>\n<dt id=\"why%20is%20%3Fauthor%3D%20enumeration%20not%20blocked%3F\"><h3>Why is ?author= enumeration not blocked?<\/h3><\/dt>\n<dd><p>If you are logged in as an administrator, the plugin does NOT block the author page \u2014 this is normal behavior. To test, use an incognito window without a WordPress session.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>1.0.0<\/h4>\n\n<ul>\n<li>First release.<\/li>\n<li>Modules: XML-RPC, WP version, file editor, emojis, user enumeration (?author= and \/author\/), REST enumeration, sensitive paths, security headers, login protection, IP whitelist, email notification, activity log, server rules.<\/li>\n<li>IP detection with Cloudflare support (CF-Connecting-IP), X-Forwarded-For\/X-Real-IP and REMOTE_ADDR.<\/li>\n<li>Admin panel with tabs: Dashboard, Hardening, Login, Logs, Server.<\/li>\n<li>Automatic log cleanup via WP Cron with configurable retention.<\/li>\n<li>Clean uninstall (options, events table, transients).<\/li>\n<\/ul>","raw_excerpt":"WordPress hardening and login protection: security headers, enumeration blocking, rate limiting, IP whitelist, event logging and server rules.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/sr.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/305847","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sr.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/sr.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/sr.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=305847"}],"author":[{"embeddable":true,"href":"https:\/\/sr.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/reinajhon46"}],"wp:attachment":[{"href":"https:\/\/sr.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=305847"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/sr.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=305847"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/sr.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=305847"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/sr.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=305847"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/sr.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=305847"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/sr.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=305847"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}