About this plugin
Balui Security Suite, by Balui Digital, protects WordPress sites without dozens of screens. Everything is configured from one modern dashboard with light and dark themes, ready to be translated. It is designed for site owners without technical knowledge: the defaults are safe and every option explains what it does.
- Two-step verification: authenticator app (TOTP, RFC 6238) or one-time email codes, recovery codes and remembered devices. Each user turns it on from their profile. Works on wp-login.php, WooCommerce “My account” and any form that uses the WordPress login.
- Login attempt limit: per account and per IP, progressive lockouts, notifications and generic error messages that never disclose whether a user exists. Also protects the WooCommerce login.
- Password policy: minimum length, character mix, no username or email inside the password, and breached-password detection with Have I Been Pwned (k-anonymity).
- CAPTCHA with ALTCHA (proof of work solved in the browser and checked on your own server: no keys, no cookies and no third parties) on login, registration, lost password, comments and WooCommerce.
- Custom login URL: wp-login.php and /wp-admin/ stop answering for visitors.
- Security headers: HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP/CORP and a Content-Security-Policy you write (Report-Only first, then enforced). A checker shows the headers your site really sends.
- Hardening: XML-RPC, application passwords, REST user listing, user enumeration, file editor, PHP in uploads, directory listing, sensitive files, version disclosure, pingbacks, forced HTTPS for the dashboard and more.
- Integrations: detects management panels, supplier syncs, payment gateways and AI assistants, and tells you before a protection would cut one of them off.
- Comments: disable everywhere or per content type, close existing threads, hide the UI and the feed, or strip links.
- Security score and one-click recommendations, activity log (you choose how many days it is kept), privacy tools integration, settings export and import, WP-CLI commands.
Balui Security Suite Pro
Balui Security Suite Pro is a separate plugin that includes everything above and adds a firewall with country blocking, CAPTCHA services from external providers (Cloudflare Turnstile, hCaptcha, Google reCAPTCHA, Friendly Captcha, MTCaptcha), a Content-Security-Policy assistant with automatic nonces for an A+ grade, passkeys, magic links, temporary access, two-step verification required by role, password expiry and history, session control, an integrity scan, vulnerability alerts, activity log export to CSV, weekly reports, WooCommerce “My account › Security”, multisite and support.
When you install it, it replaces this plugin and keeps all your settings. This plugin is complete on its own and never needs Pro to work.
External services
Balui Security Suite only connects to other services for the features below. Nothing is sent to Balui Digital.
- Have I Been Pwned (Pwned Passwords), only if you turn on “Reject breached passwords” (off by default). Then, when a password is set or checked, the first 5 characters of its SHA-1 hash are sent to api.pwnedpasswords.com; the password itself, the site address and user data never leave the site. Terms, privacy.
- Your own site: the “Check now” button in Headers requests your home page to read the headers it returns, and after removing lines from.htaccess or.user.ini (Hardening › Server files) the plugin requests your home page and one admin stylesheet to make sure the site still works. Nothing is sent anywhere else.
Third-party libraries
The plugin includes these open-source libraries, unmodified. Their readable source code is public:
- ALTCHA widget 2.2.4 ( assets/altcha.min.js ), MIT license. Source: github.com/altcha-org/altcha, file dist/altcha.i18n.umd.js of the npm package altcha.
- QR Code Generator 2.0.4 by Kazuhiko Arase ( assets/qrcode.js ), MIT license. Source: github.com/kazuhikoarase/qrcode-generator, file dist/qrcode.js of the npm package qrcode-generator.
- Geist and Geist Mono fonts ( assets/fonts/ ), SIL Open Font License 1.1 ( assets/fonts/OFL.txt ). Source: github.com/vercel/geist-font.
The rest of the CSS and JavaScript is not minified.