Skip to content

SecurityKit 0.1.1

Choose a tag to compare

View all tags
@RbnCore RbnCore released this 31 Oct 13:27
· 2 commits to main since this release
0.1.1
f075a9f

First public release of SecurityKit, a hardening plugin for WordPress. It closes the
public doors a WordPress site leaves open, one switch at a time, and tells you what it
changed. It is not a firewall and not a malware scanner.

Important: none of the modules is on after installation. A fresh install changes
nothing on your site until you switch a module on.

Modules (all off by default)

  • Security headers — X-Content-Type-Options: nosniff, Referrer-Policy,
    Permissions-Policy and X-Frame-Options. HSTS and CSP are separate switches and
    stay off until you turn them on. A header the server already sends is never sent
    twice.
  • XML-RPC — close it completely, or only stop the multicall amplification. Jetpack
    calls can be kept open.
  • User enumeration — closes /?author=N and the /wp-json/wp/v2/users endpoint.
    Logged-in users are not affected.
  • Version details — removes the generator tag and the WordPress version from core
    asset URLs. Theme and plugin versions stay, so browser caches keep working.
  • File editor — closes the theme and plugin editor with a capability filter; no
    wp-config.php change needed.
  • Login attempts — locks an address for a while after too many wrong passwords,
    using atomic counters. Proxy header trust is a switch, and addresses can be
    whitelisted.
  • wp-config.php advice — lists the recommended constants that are missing. It never
    writes the file.
  • Activity log — records sign-ins, user and role changes, plugin and theme changes,
    setting changes and blocked file-editor attempts in the central AdminKit log. Names
    and addresses are kept only as a daily salted digest; old rows are pruned nightly.
  • E-mail alerts — one plain-text message when a new administrator appears, too many
    sign-ins fail, an address is locked out, or a protection is switched off. Each event
    type is limited to one message per time window.
  • Security score — adds the state of the site up into one number between 0 and 100
    and lists the weakest points with the exact fix. Read-only: it changes nothing and
    contacts no external service.

Recovery

If you lock yourself out (for example with the login limit), add
define( 'SECURITYKIT_DISABLE', true ); to wp-config.php: no module starts while
this constant is set.

Requirements and behaviour

  • The AdminKit plugin is required (Requires Plugins: adminkit); install and
    activate AdminKit first. SecurityKit adds no hook without it.
  • WordPress 6.5+ and PHP 8.1+.
  • Updates are signed (Ed25519 + SHA-256) and follow the central AdminKit network
    setting.
  • A module that is off adds no hook and does not load its code.

SHA-256: ba6ace827cc8c5842d41dd76eb6d3fc80ac034a565c6bbee8a24d67eda7a622d

Assets 5
Loading