About this plugin
YuraCode Security helps keep your WordPress site safe from the moment you activate it. There’s nothing to set up. Every protection is already on with safe, recommended settings.
You can review or change anything on the Settings → YuraCode Security screen.
We protect your site in three simple ways: Closing Security Loopholes, Stopping Password Guessers, and Filtering Bad Traffic.
1. Closing Security Loopholes
- Hides your WordPress version: Attackers scan for specific WordPress versions with known bugs. We hide yours so you’re not an easy target.
- Locks down the file editor: Intruders often use the built-in editor to plant malicious code. We turn it off so a compromised account can’t ruin your site.
- Doesn’t reveal usernames: Shows the same generic error whether the username or the password is wrong, so attackers can’t tell which accounts are real.
- Turns off risky features: We switch off little-used features that attackers often abuse to get in, like XML-RPC and application passwords.
- Blocks AI requests: Turns off WordPress’s AI client so plugins and core can’t send prompts out from your site.
- Adds browser protection: Tells visitors’ browsers to be stricter with your pages, which blocks a few common disguise tricks and stops other sites from pretending to be you.
- Optional spam protection: Turn off comments entirely to stop comment spam bots (off by default).
2. Stopping Password Guessers
- Blocks “Brute Force” attacks: Attackers use automated bots to guess thousands of passwords a second. YuraCode watches your login form and instantly locks out anyone who guesses wrong too many times (default: 5 failed attempts locks them out for 15 minutes).
3. Filtering Bad Traffic (Firewall)
Think of this as a bouncer at the door of your website. It checks every visitor before your site even loads and kicks out the troublemakers.
* Blocks malicious visitors: Recognizes known attack patterns and blocks them immediately.
* Protects your private files: Ensures sensitive files (like your site’s database settings, backups, log files, and the WordPress version files) can’t be downloaded by strangers.
* Stops malicious uploads: If an attacker manages to upload a file, this prevents the file from actually running any harmful code on your server.
Privacy
YuraCode Security makes no external requests and collects zero user data. It runs entirely on your server. The only files it writes are its own local settings and the firewall rules it manages (with an automatic backup of your original file kept in the uploads folder).
Credits
The built-in firewall ruleset is the excellent 8G Firewall by Perishable Press.