Stoutwall

Stoutwall applies a set of well-known hardening measures that most sites should have, each behind its own switch. There is no firewall, no scanner and no account to create: it changes how WordPress behaves, and you can see and undo every change.

What it can do

• Prevent code execution in uploads – adds rules to wp-content/uploads/.htaccess that block PHP files, including .phtml, .php5, .phar and double extensions such as image.php.jpg. Rules from other plugins in the same file are kept.
• Disable XML-RPC – turns off every XML-RPC method, including pingback.ping, which is often abused for DDoS amplification, and removes the X-Pingback header.
• Prevent user enumeration – stops ?author=N lookups and hides usernames from the REST API for visitors, the users sitemap and oEmbed responses. Authors and editors keep the author list in the block editor.
• Generic login errors – the login form no longer tells attackers whether a username exists. Registration errors are still shown.
• Disable file editors – removes the theme and plugin file editors from the dashboard.
• Disable registration – keeps “Anyone can register” off.
• Block the “admin” username for new registrations.
• Hide username as display name – users cannot save a profile whose public display name is their login.
• Hide the WordPress version from the page head and feeds.
• Remove the X-Powered-By header that reveals the PHP version.
• Disable directory browsing in the uploads folder.

A Check Module Status button on the settings page confirms that each measure is really in effect on your server, for example that the .htaccess rules are present, not only that the switch is on.

Privacy

Stoutwall does not collect data, does not send anything to external servers and does not add cookies.