About this plugin
ELADIVINE Core hardens a WordPress site in one plugin: security headers, login protection, REST API and XML-RPC limits, user enumeration blocking and safer uploads. It switches on with sensible defaults, and every part has its own switch on one settings screen.
It never doubles up. Before it registers a protection, ELADIVINE Core checks whether another active plugin already provides it, and if so it leaves that job to the other plugin. Two login lockouts or two login URL renames on one site are worse than one: you get locked out at thresholds nobody can explain.
What it does
- Security headers: HSTS, X-Frame-Options, Referrer-Policy and a report-only Content Security Policy.
- Login protection: rate limiting with a lockout after a set number of failed attempts, a honeypot field, blocked usernames, optional immediate lockout on unknown usernames, and an e-mail to the site administrator when a real account is locked.
- Custom login URL: move the login page to an address of your choice.
- REST API and XML-RPC: an allowlist for guests, XML-RPC switched off, the users endpoints hidden, oEmbed optional.
- User enumeration: author scans and?author= lookups blocked.
- Uploads: JPEG quality, SVG uploads with a content check, and safe file names.
- Managed.htaccess rules on Apache, written in one marked block and checked by loading the site right after.
- Smaller things: the file editor switched off, generator tags hidden, fake search-engine bots blocked (verified by reverse DNS), image hotlinking blocked, attachment pages and author archives redirected, Heartbeat throttled.
- Site Health: tests that tell you which protections are off and which plugins overlap.
Everything above runs without a licence, an account or a connection to any server of ours.
Pro add-on
il. txt and AI crawler policy), a capability scan, site-specific code, branding and WooCommerce tuning. ELADIVINE Core does not need it and contains none of its code.