YuraCode Security

YuraCode Security protects your site the moment you activate it: no setup, no dashboard clutter, no external calls. Three focused modules cover the essentials: hardening, brute-force login protection, and an Apache-level firewall, all controlled from a single settings screen. Settings are managed on the Settings → YuraCode Security screen.

Hardening

• Disable XML-RPC – turns off the XML-RPC API and removes the pingback header, RSD link, and wlwmanifest link.
• Restrict REST API to logged-in users – returns a 401 for anonymous REST requests.
• Hide WordPress version – removes the generator meta tag, the ?ver= query string from enqueued scripts and styles, and the shortlink and REST output links.
• Generic login error messages – stops username/email enumeration on the login form.
• Disable emojis – removes the emoji detection script and styles from the front end and admin.
• Disable self-pingbacks – prevents the site from pinging itself when linking to its own posts.
• Disable application passwords – turns off Application Passwords for authenticated REST/API access.
• Disable AI prompts – prevents WordPress or plugins from executing prompts through the AI Client API (WordPress 7.0).
• Disable comments – removes comments everywhere: blocks new comments and trackbacks, hides existing comments and their counts, blanks the comment template, blocks comment feeds and the REST/XML-RPC comment APIs (block notes are preserved), and removes the Comments admin UI. Existing comments stay in the database.

Login Protection

• Limit failed login attempts – tracks failures per IP address and locks the offender out for a configurable duration.
• Maximum attempts – the number of failures allowed before lockout (default 5).
• Lockout duration – the lockout length in minutes (default 15).

Firewall (.htaccess / 8G)

Writes a rules block to the .htaccess file in the WordPress root (and, optionally, wp-content/uploads/.htaccess). Rules run at the Apache level, before WordPress loads. The block is kept between its own markers so it never conflicts with WordPress’s own rewrite rules, and a backup of your original file is kept in wp-content/uploads/yuracode-security/ before every change (removed on uninstall).

• 8G Firewall – the built-in ruleset by Perishable Press, with independently toggleable categories:
  • Block malicious query strings
  • Block malicious request URIs
  • Block bad user agents
  • Block bad referrers
  • Block suspicious cookies
  • Block dangerous request methods
• Protect wp-config.php and sensitive files – denies access to wp-config.php, php.ini, error_log, and .sql / .log backup files.
• Block direct access to wp-includes – 403s direct requests to PHP files under wp-includes, wp-admin/includes, and wp-includes/theme-compat.
• Block PHP execution in uploads – writes a wp-content/uploads/.htaccess that denies *.php, *.phtml, and *.phar files.

All firewall rules use Apache 2.4 syntax (Require all denied). On activation the .htaccess block is written immediately; on deactivation it is removed. Servers that don’t honor .htaccess (nginx, IIS) are detected automatically and the firewall is skipped with an admin notice. If the .htaccess file is not writable, an admin notice is shown and the firewall is skipped gracefully.

Privacy

YuraCode Security makes no external requests and collects no user data. It runs entirely on your server; the only files it writes are its own settings and the managed .htaccess rules (with a backup of your original kept in the uploads folder). Nothing is sent anywhere.

Credits

The built-in firewall ruleset is the 8G Firewall by Jeff Starr (Perishable Press), bundled under the GPL.