Securizer

Securizer is a lightweight WordPress security and diagnostics plugin focused on local protection, verification and reporting. It provides login protection, hardening, core integrity, Safe Repair, diagnostics and account hygiene without a Securizer cloud service. Read-only checks do not repair files. Disruptive actions require administrator confirmation; safety-sensitive workflows use verification and rollback. Login Protection

• Progressive IP lockouts for repeated failed login attempts
• Targeted-account activity detection
• Exact-IP whitelist and blacklist
• Active lockout management and manual unlock
• Security event logging
• Configurable client IP detection, including Cloudflare support
• Compatibility warnings for overlapping login-protection plugins

Safe Login URL Securizer can provide a custom login path and hide normal anonymous access to wp-login.php and wp-admin. The new route is verified before the default route is hidden, and the previous configuration is restored if verification fails. An emergency recovery constant is available if access problems occur. WordPress Hardening Hardening controls cover XML-RPC and pingbacks, generator exposure, author enumeration, REST API user exposure, the file editor, Application Passwords, security headers, directory listing and public access to PHP-like files inside uploads. Potentially incompatible server-level changes are not forced automatically. Core Integrity and Safe Repair Core Integrity compares WordPress core files with official checksums and identifies modified files, missing official files and unexpected files inside wp-admin and wp-includes. Scanning is read-only. For selected modified or missing files, Safe Repair downloads the matching official WordPress package, reads only selected files into memory, verifies checksums, writes them through the WordPress Filesystem API and scans again. Pre-repair contents remain in memory for rollback if verification fails. Unexpected files are reported and not deleted. Diagnostics and Safe File Protection Diagnostics checks security configuration, public exposure, HTTPS/SSL behavior, headers, file/directory protection and WordPress configuration. Some checks request the site's public URLs to verify effective behavior. Safe File Protection can verify directory listing and denial of PHP-like requests in uploads. Its uploads test requests a randomized, non-existent PHP-like URL and creates no probe file. Where supported, Securizer can apply its own marked rules, verify the result immediately and roll back a newly applied rule when it cannot confirm a safe and effective change. Account Hygiene, Salts and Logs Account Hygiene reviews administrator usernames, active sessions and Application Passwords, and includes a controlled administrator login-name change workflow. Securizer also audits the eight WordPress authentication keys and salts without displaying or storing their values; explicit rotation includes verification and rollback. Security events are stored locally and can include IP address, attempted username, event type, timestamp and limited event context. Passwords and authentication secrets are never logged. Logs can be reviewed in WordPress administration and exported as CSV. What Securizer is not Securizer is not a WAF, cloud malware scanner or vulnerability-intelligence service. It does not replace secure hosting, backups, updates or a dedicated firewall where required.

1. Install Securizer through the WordPress plugin installer or upload the plugin ZIP.
2. Activate Securizer.
3. Open Securizer from the WordPress administration menu.
4. Review the initial Diagnostics and Core Integrity baseline.
5. Review Login Protection and Hardening settings and adjust them if needed.

A new installation stores conservative defaults and schedules a read-only Diagnostics and Core Integrity baseline. It does not repair files, rotate authentication salts, change the login URL or apply server-level file-protection rules.

1.0.4

• Corrected Core Integrity locale selection. When only en_US fallback checksums are available, verification is partial and Safe Repair is blocked for that result.

1.0.3

• Hardened Cloudflare client-IP detection.
• Prevented Diagnostics warnings with repeated security headers.
• Prevented event logging errors when WordPress temporarily uses a database prefix without the Securizer event table.

1.0.2

• WordPress.org review-compliance fixes for safer salt rotation, Safe Login URL styling, Safe Core Repair, uploads protection verification and runtime path compatibility.