WT Hardening
| 开发者 | webmastersteam |
|---|---|
| 更新时间 | 2026年7月7日 17:53 |
| 捐献地址: | 去捐款 |
| PHP版本: | 8.0 及以上 |
| WordPress版本: | 7.0 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
WT Hardening is a lightweight, modular security plugin that turns on the most important WordPress hardening measures without modifying your theme,
wp-config.php, or .htaccess. Everything works through WordPress hooks and can be disabled at any moment with a single click.
The plugin is completely free, without a PRO version, without ads, and without sending data to external servers. Built by the webmasters.team crew for daily WordPress work.
Modules
- XML-RPC - blocks
xmlrpc.php(403) and filters the XML-RPC methods. Stops brute-force attacks through the most attacked WordPress endpoint. - User enumeration - hides logins by blocking
/wp/v2/usersin the REST API for unauthenticated users. - Author archive - redirects
/?author=1to the homepage (another enumeration vector). - Hide oEmbed author - strips
author_nameandauthor_urlfrom oEmbed responses (WPScan-detectable user-enumeration vector) and drops the oEmbed discovery<link>tags from<head>. - Hide WP version - removes the
<meta name="generator">tag,?ver=query strings from assets, and redundant meta tags (wlwmanifest, rsd, shortlink). - X-Pingback - removes the
X-PingbackHTTP header from all responses. - Login errors - replaces the specific "wrong login / wrong password" messages with a single generic text (does not reveal whether a login exists).
- Login limiter - blocks an IP for X minutes after N failed attempts. Data lives in a dedicated table (not
wp_options), with hourly cleanup of old entries. - File editor - sets
DISALLOW_FILE_EDIT, hiding the theme and plugin editor in the admin (an attacker who compromises an account cannot inject a backdoor through the browser). - Password policy - enforces minimum length and complexity (upper and lower case, digits, optionally symbols) for profile updates, registration, and password reset.
- Security HTTP headers -
X-Frame-Options,X-Content-Type-Options,Referrer-Policy,Permissions-Policy, optionallyHSTS(use with care - browsers cache it for a year). - Event log - records logins (successful and failed), registrations, user changes, plugin activations and deactivations, theme switches, and settings updates. Retention defaults to 30 days. Visible in the admin panel.
- Modular architecture - each module is a separate class and can be disabled in the settings without affecting the others.
- Zero external dependencies - no Composer, no vendor lock-in, no cloud APIs.
- No data leaves the instance - everything stays in the local MySQL/MariaDB database.
- Internationalization ready - full coverage with
__()/esc_html__()and a POT file for translators. - Clean uninstall - when the plugin is removed, options, tables, and cron jobs are dropped.
- Does not scan for malware - that is a different problem, a different toolset.
- Does not ship telemetry to the cloud - all data is local.
- Does not add a WAF at the application layer - that belongs to the server or CDN.
安装:
Standard install
- In the WP admin go to Plugins → Add new.
- Search for "WT Hardening".
- Click Install and then Activate.
- Open the WT Hardening menu in the admin (shield icon) and configure the modules.
- Download the archive from wordpress.org/plugins/wt-hardening.
- In the WP admin go to Plugins → Add new → Upload plugin.
- Pick the downloaded ZIP, click Install now, and then Activate plugin.
- Unzip the archive.
- Upload the
wt-hardeningfolder towp-content/plugins/on your server. - In the WP admin go to Plugins → Installed plugins and activate WT Hardening.
屏幕截图:
常见问题:
Does the plugin modify wp-config.php or .htaccess?
No. Everything is wired through WordPress hooks. Deactivating the plugin instantly reverts all changes (except HSTS, which browsers cache - enabling HSTS is a conscious decision).
Will blocking XML-RPC break my mobile app / Jetpack / pingbacks?
Possibly, if you actually rely on them. Disable the XML-RPC module in the settings - the other protection layers stay active.
What happens to the event log on deactivation?
The table stays in the database (useful for later analysis). On full uninstall the tables are dropped cleanly.
Does the plugin work with multisite?
Tested on a single-site install. Multisite should work since we do not use superadmin-specific APIs, but it is not yet formally supported - file an issue if something breaks.
What about performance?
Modules only register the hooks they actually need. The event log is a single INSERT per event. No scanner, no background work beyond an hourly and daily cleanup of old rows. Real impact on response time: under 1 ms.
Why is HSTS disabled by default?
Because Strict-Transport-Security has a sticky effect - browsers remember the header for a year. Enabling it too early (before your entire traffic works on HTTPS without errors) can lock users out of the site for a long time. Turn it on once HTTPS is rock-solid.
Does the strong password policy apply to users created through WP-CLI or wp_create_user()?
No - the policy hooks into admin form validation (profile, registration, reset). Programmatic user creation bypasses these hooks by design. For a typical client workflow (users are created through the admin panel) this is enough.
更新日志:
1.0.5
- New module: Hide oEmbed author - removes
author_nameandauthor_urlfrom oEmbed JSON responses (a low-effort user-enumeration vector automatically picked up by WPScan) and drops the oEmbed discovery<link>tags from<head>to reduce the public surface. Enabled by default.
- Polish: refined the wording of the "Hide WordPress version" module card on the Settings screen for clarity.
- Compatibility: tested and confirmed working with WordPress 7.0 (new "Modern" admin theme, iframed editor, PHP 7.4+ baseline). "Tested up to" bumped to 7.0. No code or behavior changes.
- Fix: Plugin URI now points to a public landing page on webmasters.team (the previous URL returned 404 during review).
- Fix: readme rewritten in English to satisfy the WordPress.org July 2025 policy.
- Fix: escape output in the event log admin page (
EventsPage). - Fix: replace
parse_url()withwp_parse_url()in the XML-RPC module. - Fix: prefix global variables in
uninstall.phpand add safe-query annotations.
- XML-RPC module (endpoint block plus methods filter).
- User enumeration blocker for the REST API.
- Author archive redirect.
- Hide WordPress version.
- Remove X-Pingback header.
- Generic login error message.
- Login attempt limiter with IP lockout.
- File editor disable.
- Strong password policy (length, mixed case, digits, symbols).
- Security HTTP headers (X-Frame, nosniff, Referrer-Policy, Permissions-Policy, HSTS).
- Event log (logins, users, plugins, theme, settings) with configurable retention.