What this product does
Modern browsers and scanners expect HTTP security headers. WordPress installs often ship with none — and XML-RPC remains a common abuse surface when left wide open.
This plugin helps you ship a sensible baseline: headers such as
X-Frame-Options,
X-Content-Type-Options,
Referrer-Policy, and related hardening controls, plus a
selective XML-RPC toggle and basic
login rate limiting.
Who it is for
- Site owners who want headers without writing server config by hand
- Teams using Jetpack / remote clients that still need limited XML-RPC paths
- Agencies standardizing hardening across Melbourne and New Mexico client sites
Free vs Pro (accurate matrix)
Free includes
- Basic security headers — practical defaults you can enable from wp-admin
- XML-RPC toggle — selective control instead of a blind hard-cut
- Login rate limit — slow down credential stuffing attempts
Pro — $15/month
- CSP builder — Content-Security-Policy with safer iteration
- IP allowlists — lock sensitive routes for operators
- WAF-ready rulesets — patterns you can align with host WAF layers
- Audit log — who changed what and when
Install
- Get the Free ZIP from /free-plugins/.
- Upload via Plugins → Add New → Upload Plugin.
- Activate, then open the hardening screen.
- Enable basic headers on staging first; confirm the front-end and wp-admin still behave.
- Only then adjust XML-RPC and login limits on production.
XML-RPC without breaking Jetpack
A total XML-RPC shutdown can break Jetpack features and some mobile/publishing apps. Prefer selective blocking (abuse methods / anonymous pingbacks) over “turn everything off forever” unless you have verified no legitimate client needs it.
Deep dive guide: Safely disable XML-RPC without breaking Jetpack.
Headers checklist (baseline)
- Clickjacking protection (
X-Frame-Options/ frame-ancestors in CSP on Pro) - MIME sniffing protection (
X-Content-Type-Options: nosniff) - Referrer policy tuned for privacy without breaking analytics
- Optional HSTS only when HTTPS is correctly configured end-to-end
Server-level companions: .htaccess Builder.
What it does not do
- It is not a full malware scanner or managed WAF service.
- It does not replace strong passwords, 2FA, or hosting firewalls.
- For custom security product UX or enterprise rules, use Plugin & UI/UX Engineering.
FAQ
Can CSP break my theme?
Yes if you ship a strict policy too early. Pro’s CSP builder is meant for staged tightening — start report-only / permissive, then harden.
Pro pricing
$15 per month. Upgrade via /#quote.