Security Suite

A production-focused WordPress security plugin for login protection, bot defense, request hardening, rate limiting, Cloudflare Turnstile integration, and activity logging.

Plugin Details

• Plugin Name: Security Suite
• Version: 2.1.0
• Author: Wajih Shaikh
• Requires at least: WordPress 6.2
• Requires PHP: 7.4
• License: GPL-2.0-or-later

Features

• Failed-login tracking and temporary lockouts
• Progressive lockouts and generic login errors
• Optional custom WordPress login URL
• Endpoint-specific rate limiting
• Dedicated throttling for major form plugin submissions
• Automatic temporary blocks for repeated malicious scanner activity
• Excessive 404 detection
• Cloudflare Turnstile support for login, registration, password reset, and comment forms
• XML-RPC and pingback protection
• User enumeration prevention and public user-sitemap suppression
• REST user route protection
• Suspicious request, path, user agent, IP, and CIDR blocking
• Trusted proxy validation and spoof-resistant X-Forwarded-For resolution
• Browser security headers
• Security event logs and manual unblock controls
• Multisite-aware activation, new-site initialization, cleanup, and database setup
• Emergency recovery constants

Installation

1. Back up your website and database.
2. Deactivate any previous security plugin build if it is still active.
3. Upload security-suite.zip through Plugins > Add New > Upload Plugin.
4. Activate Security Suite.
5. Open Security Suite in WordPress Admin.
6. Review the production readiness checklist.
7. Test login, password reset, registration, REST integrations, caching, and checkout flows in staging.

Usage

After activation, configure the plugin in the WordPress admin area. Review recommended security settings, enable the protection layers you need, and verify the login and form flows on a staging environment before deploying to production.

Recovery Constants

Define these temporarily in wp-config.php if recovery is required:

define( 'SECURITY_SUITE_DISABLE_PROTECTION', true );
define( 'SECURITY_SUITE_DISABLE_CUSTOM_LOGIN', true );

Turnstile credentials may also be added to wp-config.php:

define( 'SECURITY_SUITE_TURNSTILE_SITE_KEY', 'your-site-key' );
define( 'SECURITY_SUITE_TURNSTILE_SECRET_KEY', 'your-secret-key' );

Privacy

Security Suite may store IP addresses, attempted usernames, user agents, event types, request categories, and timestamps for security purposes. Configure an appropriate log-retention policy and document this processing in the site's privacy policy where required.

Changelog

2.1.0

• Rebuilt the admin interface with clearer navigation and mobile section selector.
• Added a security score, protection-layer summary, recommended next steps, and improved metrics.
• Grouped recommended and compatibility-sensitive settings for safer decision-making.
• Added clearer descriptions, warnings, recovery panels, current-IP guidance, and copy buttons.
• Improved lockout, bot-block, and security-log tables with empty states and client-side filtering.
• Added unsaved-change indicators and accessible interactive controls.

2.0.0

• Renamed and rebranded as Security Suite.
• Added endpoint-specific rate limiting and recognized form-plugin throttling.
• Added automatic scanner-strike blocking and excessive 404 protection.
• Added trusted proxy verification and spoof-resistant forwarded-IP handling.
• Added Cloudflare Turnstile with server-side validation.
• Added active bot-block management and multisite-aware setup.
• Added production-readiness checks and recovery safeguards.
• Added privacy-policy guidance and safer opt-in HSTS subdomain handling.