SecurityKit 0.1.2

SecurityKit hardens the parts of a WordPress site that are open to the public, one
switch at a time, and tells you what it changed. It is not a firewall and not a malware
scanner. Nothing is on after installation: a fresh install changes nothing until you
switch a module on.

What is new in 0.1.2:

• The security score card and the overview counters refresh live. When you switch a
  module on the Security screen, the score ring and the counters in the overview update
  by themselves — no page reload, and no trip to another tab to see the new number.
  This works when AdminKit 0.1.3 or newer is active; on an older AdminKit the screen
  simply behaves as before (nothing breaks, the numbers still update on the next page
  load).

Everything from 0.1.1 is included: the ten modules (security headers, XML-RPC, user
enumeration, version details, the file editor, login attempts, wp-config.php advice,
the activity log, e-mail alerts and the security score), all off by default.

Recovery

If you lock yourself out (for example with the login limit), add
define( 'SECURITYKIT_DISABLE', true ); to wp-config.php: no module starts while
this constant is set.

Requirements and behaviour

• The AdminKit plugin is required (Requires Plugins: adminkit); install and
  activate AdminKit first. SecurityKit adds no hook without it.
• WordPress 6.5+ and PHP 8.1+.
• Updates are signed (Ed25519 + SHA-256) and follow the central AdminKit network
  setting.
• A module that is off adds no hook and does not load its code.

SHA-256: e64470b39144b2d93a7e4786f6b1e63104a12fa88c0be6d05aa37675a78b44fa

SecurityKit 0.1.1

First public release of SecurityKit, a hardening plugin for WordPress. It closes the
public doors a WordPress site leaves open, one switch at a time, and tells you what it
changed. It is not a firewall and not a malware scanner.

Important: none of the modules is on after installation. A fresh install changes
nothing on your site until you switch a module on.

Modules (all off by default)

• Security headers — X-Content-Type-Options: nosniff, Referrer-Policy,
  Permissions-Policy and X-Frame-Options. HSTS and CSP are separate switches and
  stay off until you turn them on. A header the server already sends is never sent
  twice.
• XML-RPC — close it completely, or only stop the multicall amplification. Jetpack
  calls can be kept open.
• User enumeration — closes /?author=N and the /wp-json/wp/v2/users endpoint.
  Logged-in users are not affected.
• Version details — removes the generator tag and the WordPress version from core
  asset URLs. Theme and plugin versions stay, so browser caches keep working.
• File editor — closes the theme and plugin editor with a capability filter; no
  wp-config.php change needed.
• Login attempts — locks an address for a while after too many wrong passwords,
  using atomic counters. Proxy header trust is a switch, and addresses can be
  whitelisted.
• wp-config.php advice — lists the recommended constants that are missing. It never
  writes the file.
• Activity log — records sign-ins, user and role changes, plugin and theme changes,
  setting changes and blocked file-editor attempts in the central AdminKit log. Names
  and addresses are kept only as a daily salted digest; old rows are pruned nightly.
• E-mail alerts — one plain-text message when a new administrator appears, too many
  sign-ins fail, an address is locked out, or a protection is switched off. Each event
  type is limited to one message per time window.
• Security score — adds the state of the site up into one number between 0 and 100
  and lists the weakest points with the exact fix. Read-only: it changes nothing and
  contacts no external service.

Recovery

If you lock yourself out (for example with the login limit), add
define( 'SECURITYKIT_DISABLE', true ); to wp-config.php: no module starts while
this constant is set.

Requirements and behaviour

• The AdminKit plugin is required (Requires Plugins: adminkit); install and
  activate AdminKit first. SecurityKit adds no hook without it.
• WordPress 6.5+ and PHP 8.1+.
• Updates are signed (Ed25519 + SHA-256) and follow the central AdminKit network
  setting.
• A module that is off adds no hook and does not load its code.

SHA-256: ba6ace827cc8c5842d41dd76eb6d3fc80ac034a565c6bbee8a24d67eda7a622d