Trufend

Trufend helps you protect a WordPress site with practical security controls that stay out of your way until you need them. Enable only the modules you want, review activity from a single dashboard, and keep common attack paths closed.

Free features

• IP Lock — Limit failed login attempts, block abusive IP addresses, and unblock them from the settings page.
• Login Security — Hide login hints, optional custom login URL, and email-based two-factor authentication.
• Admin User Protection — Enforce stronger administrator passwords and surface important account changes.
• Security Headers — Send common HTTP security headers such as X-Frame-Options and Referrer-Policy.
• XML-RPC Protection — Disable XML-RPC when it is not needed.
• User Enumeration Protection — Block common author-scanning techniques.
• REST API Protection — Restrict anonymous REST API access when configured.
• Comment Protection — Add a lightweight honeypot to comment forms.
• User Activity Log — Review recent security-related activity in the dashboard.
• Malware Scanner — Scan individual files for suspicious PHP patterns.
• Backups — Create manual database or site file backups in the background.
• File Permissions — Browse file and folder permissions from the WordPress admin.

External libraries

Trufend bundles the following library with its distribution:

• shewa/wp-job-queue — GPL-2.0-or-later — Background job processing for scans and backups.