JAT Site Shield 1.0.2

JAT Site Shield is a free WordPress security plugin by Jeremy Anderson Tech: login lockouts, two-factor codes, core hardening, an activity log with email alerts, and file integrity checks. One plugin, safe defaults, no account.

This is the release submitted to the WordPress.org plugin directory. Until it's listed there, install jat-site-shield.zip below with Plugins → Add New → Upload Plugin. Updating from 1.0.0 or 1.0.1? Upload it over the old version; settings, the activity log and two-factor enrollments are kept.

Changed since 1.0.1

• Documentation and support links updated for the WordPress.org launch. No changes to how the plugin works.

Still on 1.0.0? Please update: its zip is missing the QR code on the two-factor setup screen, fixed in 1.0.1.

What it does

• Login protection: lockouts after failed logins (IPv6 grouped by /64), the same answer whether or not a username exists, and an optional custom login address.
• Two-factor: codes from any authenticator app plus backup codes, required for administrators by default, with every session checked so other plugins can't skip it.
• Hardening: blocks XML-RPC, username scanning, the file editor and PHP in uploads; security headers; version hiding that keeps cache busting.
• Monitoring: activity log with CSV export, email alerts with a test button, and a daily file integrity scan against WordPress.org checksums.
• Cloudflare: real visitor IPs detected automatically and safely, plus a free Cloudflare setup guide.

Passes WordPress's Plugin Check with no errors or warnings. PHP 7.4–8.4, WordPress 6.4+.

Full details: CHANGELOG · Next up: ROADMAP · Security reports: SECURITY

Pairs with JAT Shell Scanner: Site Shield keeps attackers out; the scanner checks whether one already got in.

JAT Site Shield 1.0.1

A fix release for JAT Site Shield, a free WordPress security plugin by Jeremy Anderson Tech. Coming soon to the WordPress.org plugin directory; until then, install jat-site-shield.zip below with Plugins → Add New → Upload Plugin.

Everyone on 1.0.0 should update. Upload the new zip over the old one; settings, the activity log and two-factor enrollments are kept.

Fixed

• QR code on the two-factor setup screen. The 1.0.0 zip was missing the bundled QR library, so the setup screen showed only the manual setup key (which always worked). The library is now included.
• Browser error during two-factor setup. While an administrator was still setting up two-factor, every admin screen logged a REST error, because the API block also stopped WordPress loading the user's own preferences. That single read of their own profile is now allowed; everything else in the API stays blocked until setup is finished.

Improved

• Every pull request now builds the plugin zip and fails if a required file is missing or a development file would ship.
• Repository docs no longer point to WordPress.org pages that don't exist until the plugin is approved.

Checked

• Plugin Check 2.1.0: no errors or warnings.
• PHP 7.4 to 8.4 syntax, PHP compatibility and WordPress security sniffs pass in CI.

Full details: CHANGELOG.md · Free Cloudflare setup guide · Report a security problem privately

JAT Site Shield 1.0.0

Please use the latest release instead. The zip attached to 1.0.0 is missing the bundled QR library, so the two-factor setup screen shows only the manual setup key (which works). Fixed in 1.0.1.

First release of JAT Site Shield, a WordPress security plugin by Jeremy Anderson Tech. Coming soon to the WordPress.org plugin directory; until then, install jat-site-shield.zip below with Plugins → Add New → Upload Plugin.

What it does

• Login protection: lockouts after failed logins (IPv6 grouped by /64), the same answer whether or not a username exists, and an optional custom login address.
• Two-factor: codes from any authenticator app plus backup codes, required for administrators by default, with every session checked so other plugins can't skip it.
• Hardening: blocks XML-RPC, username scanning, the file editor and PHP in uploads; security headers; version hiding that keeps cache busting.
• Monitoring: activity log with CSV export, email alerts with a test button, and a daily file integrity scan against WordPress.org checksums.
• Cloudflare: real visitor IPs detected automatically and safely, plus a free Cloudflare setup guide.

Passes WordPress's Plugin Check with no errors or warnings. PHP 7.4–8.4, WordPress 6.4+.

Full details: CHANGELOG · Next up: ROADMAP · Security reports: SECURITY

Pairs with JAT Shell Scanner: Site Shield keeps attackers out; the scanner checks whether one already got in.