Block early.
Log everything.
Enforce when ready.
Thessley Security Hardening is a modular WordPress security plugin built around one idea: block what can be blocked before WordPress finishes loading, and make everything else visible enough to act on. Twenty-three independent modules — every one ships in log-only mode first, so you see exactly what it would have done before it ever does it.
WordPress security has a plugin problem
The numbers that shaped every module below.
of the 11,334 WordPress vulnerabilities disclosed in 2025 were in plugins.
of infections exploit a flaw that already had a patch available.
median time from public disclosure to mass exploitation.
of plugin vulnerabilities are exploitable without authenticating.
of WordPress-specific attacks are actually blocked by typical hosting-level defenses.
Everything a module finds, on one screen
No SSH session, no log-tailing. A live health score, a 7-day blocked count, and every module's state at a glance.
Composite health score
One number, rolled up from every module's current state — not a vanity metric, a summary you can act on.
7-day blocked count
What was actually stopped, separated from what log-only mode would have stopped, so enforcement claims stay honest.
Worst severity, not just a count
18/20 means something already succeeded. The dashboard leads with severity, not noise volume.
Every module, one grid
Status, mode, and last activity for each module — scannable in seconds, filterable when it isn't.
Independent by design
Each module does one job. Turn any of them off and the rest keep working. Grouped here exactly as they're grouped in the dashboard.
01Perimeter — blocks by IP, country and rate
IP Blocklist
Pulls CINS Army, DShield, Spamhaus DROP, FireHOL, ET Tor and a private WordPress-targeting feed daily, compiled into one merged, sorted-range file.
Whitelist
A trusted-networks CIDR feed plus individually-listed IPs, exempt from every other blocking module.
Geo Blocker
Blocks or allows traffic by country, checked at the same pre-boot gate as the IP blocklist.
Geo Login
Restricts wp-login.php to an allow-list of countries, independent of the site-wide Geo Blocker.
Rate Limiter
Throttles requests per IP site-wide, escalating sustained floods into the shared local blocklist.
02Request inspection — looks at what a request is doing
Query Guard
Signature scanning for SQLi, XSS, traversal, command injection and known CVE exploit strings, in query strings and request bodies.
Login Guard
Per-IP failed-login rate limiting with lockout, escalating repeat offenders to the early gate.
03Detection — is anything already wrong
File Integrity
Core verified against WordPress.org's published checksums — authoritative even if installed after the fact.
Malware Scanner
Scans plugin, theme and upload files for webshell markers, obfuscated eval chains and injected spam.
Vulnerability Scan
Flags outdated components, plugins pulled from the .org directory, and anything unmaintained for two years.
User Watchdog
Watches privileged accounts through WordPress hooks, and separately by hourly snapshot diff.
04Hardening — reduces what an attacker can do after getting in
Security Headers
CSP, HSTS, frame and referrer policy. The two that can genuinely break a site are off by default.
User Enumeration
Blocks ?author=N probing, anonymous REST user listing across a dozen plugin ecosystems, and oEmbed author leakage.
Hardening
Disables the dashboard file editor, blocks PHP execution in uploads, and finds plugins that hide themselves from the plugin list.
05Overview — everything every module has seen, on one screen
Event Log
One filterable table every module writes to, so the answer to "what happened" is not an SSH session.
Event Map
Blocked and logged events tinted on a world map by country, reusing the Geo Blocker's own compiled dataset.
Activity Log
The mundane admin audit trail — who published, deleted, installed or changed what — separate from attack detections.
Bot Log
Every verified visit from a known crawler — Googlebot, Bingbot and the rest — kept apart from the Event Log, since it's expected traffic, not something to review for attacks.
06Ops — keeping the above current and knowing when it fires
Auto Updates
Installs what the vulnerability scan flagged, rather than waiting for someone to read the report.
Alerts
Real-time Telegram and email notification for events above a severity threshold, with a cooldown so a scanner can't flood you.
IP Sharing
Shares genuine blocks with a self-hosted IP reputation tracker — only actual blocks, at most once per IP per hour.
Scan All
One button for File Integrity, Malware Scanner, Vulnerability Scan and User Watchdog, run in the background.
Import/Export
Back up or restore every module's settings as a single JSON file, with each module optionally left out.
It runs before WordPress does
One severity scale, every module — from the first byte of the request.
Incoming request
Any HTTP request to the site, before anything else runs.
Must-use pre-boot gate
IP blocklist, query scanning, POST/upload checks — before WordPress, themes, or any plugin loads.
WordPress & in-app modules
File integrity, user watchdog, vulnerability scan — reporting to the same event log.
The enforcement layer runs as a must-use plugin, loaded before WordPress finishes bootstrapping. Every request is checked against the IP blocklist, scanned for malicious query patterns, and validated on POST and upload — before WordPress, themes, or any other plugin gets a chance to run.
Everything else — file integrity, user watchdog, vulnerability scanning — runs inside WordPress and reports back to the same place.
One severity scale, every module
Low numbers are noise. High numbers mean this needs a look. 18 or above means something already succeeded — not just an attempt.
What this plugin can't do
We'd rather tell you than let you assume.
A WordPress plugin only ever sees requests that reach PHP. If a file genuinely exists — an exposed .git directory — the web server serves it directly.
Probe detection for sensitive paths depends on the site's permalink structure routing 404s into WordPress.
Baseline comparison for plugins and themes detects change since the baseline was taken — not whether the current state was clean.
An IP allowlist only helps for services that publish stable ranges. Mobile apps, desktop clients and pingbacks arrive from arbitrary addresses.
Under active development
All twenty-three modules are built and tested, and pass WordPress.org's own Plugin Check with zero errors. Thessley Security Hardening is not yet on the public plugin directory, but it's already running on real sites — several modules in full enforcing mode, not just logging. Every install still ships in log-only mode by default, until it has earned enforcement on that site specifically.
Follow development ↗