KUMITATE HOSHU

KUMITATE HOSHU (“kumitate-hoshu” is Japanese for protection) closes the ways most WordPress sites get broken into, with as little to configure as possible. Activate it and the protections that cannot lock you out are already on. Everything else is one switch, explained in plain words.

Login

• Limit login attempts: repeated failures from one address or for one user name are refused for a while, and the password is not even checked during the lock.

• Two-factor login: each user can add a time-based code from Google Authenticator, Microsoft Authenticator, Authy, 1Password or any other authenticator app, with single-use recovery codes.

• Change the login address (off by default): serve the login page at an address of your choosing and answer wp-login.php and the admin area with “not found” for visitors.

Fewer ways in

• Hide user names: the author archive by number, the public users endpoint of the REST API, the users sitemap and login errors that confirm a name all stop giving names away.

• Close unused doors: XML-RPC and pingbacks off, the theme and plugin file editors removed, the WordPress version hidden.

• Security headers: X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy on every response.

Checks

• Settings check: a score out of 100 and a list of what to fix and how, from debug output to a user named “admin”, PHP files in uploads, missing secret keys and waiting updates.

• File integrity: the WordPress files on the server compared with the official list from WordPress.org, weekly and on demand; changed, missing and unexpected files are listed.

• Known vulnerabilities: installed plugins, themes and WordPress compared with a public vulnerability list, weekly and on demand.

• A log of logins, locks, backups, updates and checks, kept for 90 days and at most 20,000 entries, with addresses stored as hashes.

Keep

• Backups: wp-content and the database in one.wpress file, the format All-in-One WP Migration (ServMask Inc.) imports, so a backup can also move a site elsewhere. Made by hand or every day or week, kept in a folder closed to visitors, with a chosen number of generations, and downloadable from the same screen. Restore from there too; the current state is backed up first. A.wpress from another site can be uploaded on the same screen and restored, with addresses and paths rewritten.

• Automatic updates with a backup first: once a day, waiting plugin and theme updates are installed after a backup; the front and login pages are checked, and if the site stopped answering properly the updated items are put back from that backup and you get an e-mail.

org through the normal WordPress upgrader. The plugin never changes where updates come from.

What this plugin does not do: it cannot protect the web server or operating system, stop a denial-of-service attack, or help once an attacker can already run PHP on the server. Keep WordPress, plugins and themes updated and keep backups away from the server.

External services

org and the vulnerability list” under KUMITATE HOSHU > Settings.

• WordPress.org (api.wordpress.org): the file integrity check downloads the official checksum list for the installed WordPress version and locale. The request carries the version and locale. Privacy policy

• WPVulnerability (www.wpvulnerability.net), an open vulnerability database (CC0) that gathers records from NVD, Patchstack, WPScan, Wordfence and others: the vulnerability check sends one request per installed plugin and theme carrying its folder name, and one carrying the WordPress version, and compares the answers on your server. The requests carry no site address or other information about your site; only matching entries are kept. About the API · Privacy · License