About this plugin
Flex Website Security is a lightweight hardening toolkit — not a full WAF or malware scanner. It reduces common attack surfaces: brute-force logins, XML-RPC abuse, user enumeration, and loose admin defaults.
- Limit failed login attempts, with a lockout list you can unblock immediately
- Permanently block or unblock IPs
- Restrict by country: Allow from or Restrict from, on the whole site or admin only
- Custom login URL and hide wp-admin for guests
- Optional Cloudflare Turnstile or Google reCAPTCHA on login forms
- Login honeypot and generic login errors
- Disable XML-RPC and the theme/plugin file editor
- Hide WordPress version
- Block user enumeration
- Basic security headers (HSTS is left to Flex SSL)
Admin CSS and JavaScript ship with the plugin. Remote scripts and API calls run only when you enable captcha or the optional country lookup.
Privacy
IP lockouts and permanent blocks are stored in your WordPress database. Only administrators can view or change them on Flex Website Security → Access.
Captcha (off by default): if you choose Cloudflare Turnstile or Google reCAPTCHA and save both keys, the login form loads that provider’s script and sends the visitor IP plus the captcha token to the provider for verification.
Country lookup (off by default): country rules first use CDN headers (Cloudflare, CloudFront, and similar). io and cached for 7 days.
See Third-party services below for URLs, terms, and privacy policies.
Third-party services
These services are optional and off by default. io lookup.
Cloudflare Turnstile
com/turnstile/v0/siteverify. Cloudflare receives the visitor IP and token.
- Service: https://www.cloudflare.com/application-services/products/turnstile/
- Terms: https://www.cloudflare.com/website-terms/
- Privacy: https://www.cloudflare.com/privacypolicy/
Google reCAPTCHA
com/recaptcha/api/siteverify. Google receives the visitor IP and token.
- Service: https://www.google.com/recaptcha/about/
- Terms: https://policies.google.com/terms
- Privacy: https://policies.google.com/privacy
geojs.io
io/v1/ip/country/{ip} and cached for 7 days.
- Service: https://www.geojs.io/
- Terms / privacy: https://www.geojs.io/
License
Flex Website Security is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 2 of the License, or (at your option) any later version.
html.