Brightery File Lockdown

Brightery File Lockdown reduces the impact of a compromised WordPress administrator account by restricting high-risk code and upload capabilities.

In standard plugin mode it:

• Disables theme and plugin source-editing capabilities.
• Blocks installation of new plugins and themes from wp-admin.
• Blocks plugin and theme ZIP uploads.
• Blocks plugin and theme deletion from wp-admin.
• Keeps core, plugin, and theme updates configurable.
• Restricts uploads to an explicit image, audio, and video allowlist.
• Rejects executable, script, archive, and configuration-file extensions.
• Rejects suspicious double extensions such as example.php.jpg.
• Uses WordPress file-type validation plus server-side MIME detection when available.
• Applies the same upload checks to normal uploads and sideloaded uploads.
• Keeps a bounded local record of the latest 100 blocked security events in the WordPress database.

The plugin does not contact Brightery or any external service, does not send telemetry, and does not collect IP addresses or WordPress user IDs.

Admin-resistant Must-Use mode

A normal WordPress plugin can always be deactivated by an administrator. If your security goal is to remain active after a WordPress administrator account is compromised, use the optional Must-Use loader included in the mu directory.

For WordPress.org transparency and normal plugin lifecycle behavior, Brightery File Lockdown does not copy or install itself into wp-content/mu-plugins automatically.

A trusted server administrator may manually deploy the Must-Use mode using two files from this package:

1. Copy mu/brightery-file-lockdown-mu-loader.php to wp-content/mu-plugins/brightery-file-lockdown.php.
2. Create wp-content/mu-plugins/brightery-file-lockdown/ and copy includes/class-brightery-file-lockdown.php into that directory as class-brightery-file-lockdown.php.

The deployed MU loader resolves the copied engine relative to the loader’s own location. It does not rely on WP_PLUGIN_DIR or the normal plugin directory name. This lets the Must-Use protection continue loading even if the normal plugin is deactivated or its directory is renamed.

Remove both manually deployed Must-Use files with trusted filesystem access before uninstalling the normal plugin.

This plugin is a hardening layer, not a guarantee against compromise. Keep WordPress, plugins, themes, PHP, and the web server updated and apply server-level upload execution restrictions where appropriate.

Privacy

Brightery File Lockdown does not transmit data to external servers and does not collect IP addresses or WordPress user IDs. A bounded local event record may contain blocked filenames, MIME types, block reasons, and timestamps.