Stoutwall Wordpress Plugin - Rating, Reviews, Demo & Download
Plugin Description
Stoutwall applies a set of well-known hardening measures that most sites should have, each behind its own switch. There is no firewall, no scanner and no account to create: it changes how WordPress behaves, and you can see and undo every change.
What it can do
- Prevent code execution in uploads – adds rules to
wp-content/uploads/.htaccessthat block PHP files, including.phtml,.php5,.pharand double extensions such asimage.php.jpg. Rules from other plugins in the same file are kept. - Disable XML-RPC – turns off every XML-RPC method, including
pingback.ping, which is often abused for DDoS amplification, and removes theX-Pingbackheader. - Prevent user enumeration – stops
?author=Nlookups and hides usernames from the REST API for visitors, the users sitemap and oEmbed responses. Authors and editors keep the author list in the block editor. - Generic login errors – the login form no longer tells attackers whether a username exists. Registration errors are still shown.
- Disable file editors – removes the theme and plugin file editors from the dashboard.
- Disable registration – keeps “Anyone can register” off.
- Block the “admin” username for new registrations.
- Hide username as display name – users cannot save a profile whose public display name is their login.
- Hide the WordPress version from the page head and feeds.
- Remove the X-Powered-By header that reveals the PHP version.
- Disable directory browsing in the uploads folder.
A Check Module Status button on the settings page confirms that each measure is really in effect on your server, for example that the .htaccess rules are present, not only that the switch is on.
Privacy
Stoutwall does not collect data, does not send anything to external servers and does not add cookies.
Screenshots
Protections grouped by area, with a meter that shows how many are on.
The status check shows whether each protection is working.
