Plugin - Flex Website Security
Practical WordPress hardening: login limits, XML-RPC, headers, enumeration protection, and optional captcha.
- Security
- Login
- Headers
What it does
A lightweight toolkit — not a full WAF — that reduces brute-force logins, XML-RPC abuse, and user enumeration.
Optional Cloudflare Turnstile or Google reCAPTCHA, country rules, and a custom login URL.
Features
- Failed-login limits, lockouts, and permanent IP blocks
- Custom login URL and hide wp-admin for guests
- Disable XML-RPC and the theme / plugin file editor
- Block user enumeration and hide the WordPress version
- Optional Turnstile / reCAPTCHA and country allow / restrict lists
Get it
Flex Website Security is free on WordPress.org under GPLv2 or later. Install from Plugins → Add New, or download the package from https://wordpress.org/plugins/flex-website-security/.