INI Protector

INI Protector is a focused, no-bloat hardening plugin for WordPress. Every feature

is an independent toggle, grouped into three areas:

Security

• File integrity monitoring — hashes every code file (.php,.php5,.phtml,

ini …), keeps a baseline, and re-checks on a

schedule. Any file that is added, changed, or deleted is emailed to you (and

optionally POSTed to a webhook) before the baseline is updated, so the

evidence has already left the server even if the site itself is compromised.

Media is never hashed, but uploads, caches and backup folders are still checked

php among your images has no innocent explanation and

is reported as critical. Runs from WP-Cron or from system cron via

wp inipr integrity scan.

• Two-factor authentication (TOTP) — a time-based one-time code from any

standard authenticator app, required per role. The password is verified first,

then the code, before any session cookie is issued. Recovery codes are issued

at setup, and wp inipr 2fa reset <user> restores access from the shell.

• Disable XML-RPC, disable the theme/plugin file editor, require login for the

REST API.

• Limit login attempts (IP lockout), mask the login URL to a secret slug.

• Password-protect the whole front-end.

• Disable comments and pingbacks/trackbacks.

• Prevent user enumeration and information disclosure (directory listing,

htaccess rules or an Nginx

snippet).

• Hardening HTTP security headers (X-Frame-Options, X-Content-Type-Options,

Referrer-Policy, Permissions-Policy).

• ALTCHA proof-of-work login captcha (self-hosted, no third-party calls).

• Traffic monitor — records incoming requests so suspicious activity is visible,

with a per-IP drill-down. Defaults to 90 days and 250,000 requests; saved limits

are preserved. Either limit can be disabled. The row cap preserves requests

inside the auto-block evaluation window, so the count can temporarily exceed it.

• Auto-block escalation — a dedicated IP Block page that surfaces the

traffic monitor’s suggested blocks for one-click review (Block Suggestion

System), and an optional Auto-Block mode that blocks offending IPs

automatically on an escalating temporary schedule (1h → 4h → 8h → 5 days →

2 weeks). Never issues a permanent block automatically; an allowlist and

verified search-engine bots are always exempt; quiet IPs decay back down.

• Vulnerability scan — a daily check of your installed plugins, themes, and

WordPress core against the free WPVulnerability database (CC0, no API key).

Findings appear on a dedicated page and on the dashboard, with an optional

email alert on new findings. No data about your site is sent — only the

public slug of each component is looked up.

Head cleanup

• Remove the generator/RSD/WLW/shortlink tags, strip or mask asset version

query strings, drop front-end Dashicons.

Utilities

• Rotate asset cache token — changes the version token on every CSS and JS

URL at once, so returning visitors re-fetch them. Use it after a deploy when

a file has changed but the version it declares has not. Available from

INI Protector → Utilities and from wp inipr asset-salt rotate, which is

where it belongs in a deploy script.

• Export / import settings — download which protections are on and how they

are configured as a JSON file, and import it on another site. Every change is

shown before it is applied, the previous settings are kept for one-click undo,

and secrets (site password, webhook secret) are left out unless you opt in.

Also wp inipr settings export|import|undo.

SEO & privacy

• Disable feeds, disable author archives, obfuscate author slugs, and protect

email addresses from harvesting.

INI WP platform

• Exposes a read-only, HMAC-signed REST endpoint ( secwp/v1/state ) so the

INI WP control panel can pull this site’s security posture and scan results.

The endpoint only activates when the INI WP connector is installed and

configured; auth reuses the connector’s signed channel.

Notes

• Head cleanup lives here, not in SeoWP — SeoWP keeps pure SEO concerns

(titles, meta, schema, noindex directives).

-

Behind a reverse proxy or CDN, tell INI Protector which addresses your proxy

uses so it can read the real visitor IP safely:

0/20, 2400:cb00::/32’ );

X-Forwarded-For is then read only when the connection actually comes from

one of those addresses, from the trusted end — so a visitor who

reaches your origin directly cannot claim to be someone else, evade an IP

block, or get an innocent IP blocked. Without this, client IPs come from the

socket peer, which cannot be forged. Security → Scan reports which mode you

are in. The older SECWP_TRUST_PROXY constant still works but cannot check who

sent the header; replace it when you can. CF-Connecting-IP is read only if

you also define( ‘SECWP_TRUST_CF_CONNECTING_IP’, true ) — do that only when

every declared proxy is Cloudflare, since other proxies pass it through as

the visitor sent it.

External services

com/)

only when you enable Vulnerability Scan. It sends installed plugin/theme slugs

net/ to retrieve

known vulnerabilities. The service also receives the server IP address as part

of the connection. No site URL is included in the plugin’s user agent.

com/privacy/

File integrity webhooks are optional. When you configure a webhook URL and enable

alerts, reports containing the site URL, changed file paths, hashes and scan

metadata are sent to that URL. Configure only a recipient you trust; its terms

and privacy policy apply. Email alerts use your site’s configured mail service.

The optional INI WP connector allows your configured control panel to retrieve

security settings and scan results through an authenticated REST endpoint.

INI Protector does not initiate control-panel requests. Service information:

com

Source code

0, licensed under MIT.

0

json.

The widget runs locally in the browser; no ALTCHA service account is required.