About this plugin
Kwistech Secure hardens a WordPress site using only what WordPress already gives you. It is
not a firewall, not a malware scanner, and not a service — everything it does happens on your
own server, and it never contacts anybody.
Twelve controls, each independently switchable, each logged when it changes:
- Two-factor sign-in — RFC 6238 authenticator codes with one-time recovery codes. Detects
an existing 2FA plugin and stays out of the way rather than fighting it.
- Login rate limiting — counts failures by IP address and by username, so a password
sprayed across many accounts from one host and one account attacked from a botnet are both
caught. Usernames are stored only as a salted hash.
- Non-enumerating login errors — one identical message for every failure, on the sign-in
form and the password-reset form alike, so neither confirms which usernames exist.
- Custom sign-in address — moves /wp-login.php. Tests the new address before saving it
and provides a break-glass constant, because the obvious way to implement this is also the
obvious way to lock yourself out.
- File editor disabled — removes the most direct path from a stolen administrator session
to arbitrary code execution.
- XML-RPC off — closes a long-standing brute-force amplifier that most sites never use.
- Application password inventory — reports how many exist per user, never their values.
They bypass two-factor, and most people have forgotten the ones they created.
- Version fingerprints removed — generator tags, feed generators, X-Powered-By.
- Username discovery blocked —?author=1 scans, the REST user list, the user sitemap
and oEmbed author fields all stop answering anonymous callers. Author archives at their own
address keep working, and so does everything a signed-in editor needs. The control also
reports when an account’s display name is its username, because when that is true the
byline gives the game away regardless.
- Security response headers — X-Content-Type-Options, X-Frame-Options,
Referrer-Policy and X-Permitted-Cross-Domain-Policies, and never overwriting one your
server or CDN already sends. Deliberately no CSP: any policy that leaves wp-admin usable
needs unsafe-inline, which does not stop the attack CSP exists to stop.
- Enforced password policy — a minimum length, and a refusal of passwords containing the
username or the site name, applied server-side when a password is set or reset. WordPress
itself only shows a strength meter next to a “confirm use of weak password” checkbox.
- unfiltered_html restricted — via a capability filter rather than the all-or-nothing
constant, so administrators keep the workflows they need.
An append-only activity log records every setting change with the old value, the new
value, who made it, from what address, and when. There is no edit path and no single-row
delete; the only removal is the scheduled retention sweep, which logs itself.
What it does not do
Being clear about this matters more than the feature list:
- It does not scan for malware, and a clean install proves nothing about whether you are
infected.
- It does not filter traffic. It is not a WAF and cannot stop an attack in progress.
- It does not patch anything. It reports on outdated core and plugins; updating is yours.
- It cannot protect against someone who already has your administrator password and your
second factor.
Privacy
This plugin makes no third-party network request of any kind. There is no account, no
registration, no telemetry, no usage reporting, no licence check, and no remote access. It
does not phone home because there is nowhere for it to phone.
Two requests are made, both to your own website address: an HTTPS request to your home page
to check whether a security header is present, and a one-off request to a new sign-in address
to confirm it works before saving it. Neither carries anything about you.
Data stored, all locally: the activity log (400 days), failed sign-in attempts with usernames
hashed (30 days), and encrypted two-factor secrets in user meta until you turn the feature
off. Deleting the plugin removes all of it.
Optional paid add-on
A separate plugin, Kwistech Secure — Insurance Evidence Pack, generates a dated PDF and
JSON report of this site’s security posture for an insurance broker. It is sold at
ca and is not required for anything here.
Everything described on this page is free, works without it, and always will. This plugin
contains no locked functionality.