KUMITATE HOSHU Wordpress Plugin - Rating, Reviews, Demo & Download
Plugin Description
KUMITATE HOSHU (“kumitate-hoshu” is Japanese for protection) closes the ways most WordPress sites get broken into, with as little to configure as possible. Activate it and the protections that cannot lock you out are already on. Everything else is one switch, explained in plain words.
Login
- Limit login attempts: repeated failures from one address or for one user name are refused for a while, and the password is not even checked during the lock.
- Two-factor login: each user can add a time-based code from Google Authenticator, Microsoft Authenticator, Authy, 1Password or any other authenticator app, with single-use recovery codes.
- Change the login address (off by default): serve the login page at an address of your choosing and answer wp-login.php and the admin area with “not found” for visitors.
Fewer ways in
- Hide user names: the author archive by number, the public users endpoint of the REST API, the users sitemap and login errors that confirm a name all stop giving names away.
- Close unused doors: XML-RPC and pingbacks off, the theme and plugin file editors removed, the WordPress version hidden.
- Security headers: X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy on every response.
Checks
- Settings check: a score out of 100 and a list of what to fix and how, from debug output to a user named “admin”, PHP files in uploads, missing secret keys and waiting updates.
- File integrity: the WordPress files on the server compared with the official list from WordPress.org, weekly and on demand; changed, missing and unexpected files are listed.
- Known vulnerabilities: installed plugins, themes and WordPress compared with a public vulnerability list, weekly and on demand.
- A log of logins, locks, backups, updates and checks, kept for 90 days and at most 20,000 entries, with addresses stored as hashes.
Keep
- Backups: wp-content and the database in one .wpress file, the format All-in-One WP Migration (ServMask Inc.) imports, so a backup can also move a site elsewhere. Made by hand or every day or week, kept in a folder closed to visitors, with a chosen number of generations, and downloadable from the same screen. Restore from there too; the current state is backed up first. A .wpress from another site can be uploaded on the same screen and restored, with addresses and paths rewritten.
- Automatic updates with a backup first: once a day, waiting plugin and theme updates are installed after a backup; the front and login pages are checked, and if the site stopped answering properly the updated items are put back from that backup and you get an e-mail.
Plugin Check notes a “plugin updater”: that is the automatic-updates feature above, which installs updates from WordPress.org through the normal WordPress upgrader. The plugin never changes where updates come from.
What this plugin does not do: it cannot protect the web server or operating system, stop a denial-of-service attack, or help once an attacker can already run PHP on the server. Keep WordPress, plugins and themes updated and keep backups away from the server.
External services
Nothing is downloaded or sent until you turn on “Allow connections to WordPress.org and the vulnerability list” under KUMITATE HOSHU > Settings.
- WordPress.org (api.wordpress.org): the file integrity check downloads the official checksum list for the installed WordPress version and locale. The request carries the version and locale. Privacy policy
- Wordfence Intelligence by Defiant Inc. (www.wordfence.com): the vulnerability check downloads the public vulnerability list and compares it on your server with the installed plugin, theme and WordPress versions. No information about your site is sent; only matching entries are kept. Terms · Privacy policy
Screenshots
No screenshots provided
