Active installations10Adoption metric — not a quality score
WordPress.org ratingNo WordPress.org ratings yet
Official packageDirect from WordPress.org
Repository metrics are context, not quality scores. Active installations measure adoption and can strongly reflect a plugin’s age and historical popularity. Ratings, recent updates and “Tested up to” metadata also do not guarantee modern code, error-free operation, security, feature completeness or suitability for a particular site. Why active installs don’t tell the whole story →
WP PlugIndex currently records JR Security Hardening and Login Protection version 1.0.0 as active, updated 5mo ago and tested up to WordPress 6.9.
Overview
About this plugin
JR Security Hardening and Login Protection secures your WordPress installation at the application level with one-click hardening modules. Designed to be secure by default and Cloudflare compatible.
Included modules:
Disable XML-RPC — Full block (filter + hard block) to prevent brute force attacks and pingback DDoS.
Hide WordPress version — Removes version from generator meta and CSS/JS assets.
Disable file editor — Prevents theme and plugin editing from the admin panel (DISALLOW_FILE_EDIT).
Block user enumeration (?author= and /author/) — Dual-layer protection against username discovery.
Block REST enumeration (wp-json users) — Prevents enumeration via the WordPress REST API.
Block sensitive paths/files — Blocks access to readme.html, license.txt,.env,.git, composer.json, etc. (only what passes through WordPress).
Security headers — X-Content-Type-Options, Referrer-Policy, Permissions-Policy, X-Frame-Options, HSTS (HTTPS only) and removal of technology-revealing headers.
Login protection — Rate limiting by IP and by user+IP with configurable temporary lockout.
IP whitelist — Excludes trusted IPs from rate limiting to avoid accidental lockouts.
Email notification — Receive an email when an IP is locked out due to too many failed login attempts.
Activity log — Security event logging in a dedicated database table with configurable retention and automatic cleanup via cron.
Ready-to-use server rules — Code for Apache (.htaccess) and Nginx to block static files that WordPress cannot reach.
Smart IP detection:
Native support for Cloudflare (CF-Connecting-IP).
Option to trust X-Forwarded-For / X-Real-IP behind trusted proxies.
Fallback to REMOTE_ADDR.
Clean uninstall:
When the plugin is deleted, all options, the events table and transients are removed. No data is left behind in your database.
WordPress.org metadata
Plugin tags
Topics listed for this plugin in the WordPress.org directory.
login protection
hardening
security
Compatibility & maintenance
Compatibility & maintenance
Tested up to WordPress 6.9
Not yet marked as tested with WordPress 7.1. WordPress.org currently lists Tested up to 6.9.
Current WordPress releaseWordPress 7.1
WordPress.org Tested up to6.9
Minimum requirementsWordPress 5.0 · PHP 7.4
Update activity21 May 20265mo ago
“Tested up to” is directory metadata supplied by the plugin author. WP PlugIndex does not turn an older declaration into a claim that the plugin is incompatible.
Changes recorded by WP PlugIndex
Recent tracked changes
No tracked version or compatibility changes have been recorded by WP PlugIndex yet.
Tracking & source
WP PlugIndex tracks public WordPress.org directory metadata and records selected version, compatibility and availability changes as they are detected.
