Securizer is a lightweight WordPress security and diagnostics plugin focused on local protection, verification and reporting. It provides login protection, hardening, core integrity, Safe Repair, diagnostics and account hygiene without a Securizer cloud service.<\/p>\n\n
Read-only checks do not repair files. Disruptive actions require administrator confirmation; safety-sensitive workflows use verification and rollback.<\/p>\n\n
Securizer can provide a custom login path and hide normal anonymous access to wp-login.php and wp-admin. The new route is verified before the default route is hidden, and the previous configuration is restored if verification fails. An emergency recovery constant is available if access problems occur.<\/p>\n\n
Hardening controls cover XML-RPC and pingbacks, generator exposure, author enumeration, REST API user exposure, the file editor, Application Passwords, security headers, directory listing and public access to PHP-like files inside uploads. Potentially incompatible server-level changes are not forced automatically.<\/p>\n\n
Core Integrity compares WordPress core files with official checksums and identifies modified files, missing official files and unexpected files inside wp-admin and wp-includes.<\/p>\n\n
Scanning is read-only. For selected modified or missing files, Safe Repair downloads the matching official WordPress package, reads only selected files into memory, verifies checksums, writes them through the WordPress Filesystem API and scans again. Pre-repair contents remain in memory for rollback if verification fails. Unexpected files are reported and not deleted.<\/p>\n\n
Diagnostics checks security configuration, public exposure, HTTPS\/SSL behavior, headers, file\/directory protection and WordPress configuration. Some checks request the site's public URLs to verify effective behavior.<\/p>\n\n
Safe File Protection can verify directory listing and denial of PHP-like requests in uploads. Its uploads test requests a randomized, non-existent PHP-like URL and creates no probe file. Where supported, Securizer can apply its own marked rules, verify the result immediately and roll back a newly applied rule when it cannot confirm a safe and effective change.<\/p>\n\n
Account Hygiene reviews administrator usernames, active sessions and Application Passwords, and includes a controlled administrator login-name change workflow. Securizer also audits the eight WordPress authentication keys and salts without displaying or storing their values; explicit rotation includes verification and rollback.<\/p>\n\n
Security events are stored locally and can include IP address, attempted username, event type, timestamp and limited event context. Passwords and authentication secrets are never logged. Logs can be reviewed in WordPress administration and exported as CSV.<\/p>\n\n
Securizer is not a WAF, cloud malware scanner or vulnerability-intelligence service. It does not replace secure hosting, backups, updates or a dedicated firewall where required.<\/p>\n\n
Securizer has no product telemetry and does not require a Securizer cloud account.<\/p>\n\n
Core Integrity requests official checksums from WordPress.org. When an administrator explicitly runs Safe Repair, Securizer also downloads the matching official WordPress release package and reads only selected repair files from the archive in memory.<\/p>\n\n
These requests send the WordPress core version and locale needed for checksum verification or package selection.<\/p>\n\n
WordPress.org: https:\/\/wordpress.org\/\nWordPress.org Privacy Policy: https:\/\/wordpress.org\/about\/privacy\/<\/p>\n\n
Diagnostics, Safe Login URL verification and Safe File Protection can request URLs belonging to the same site to verify redirects, login-route behavior, headers, public exposure and file protection. No Securizer cloud service is involved.<\/p>\n\n
Security Logs can display a manual Lookup link for eligible public IP addresses. An IP address is opened on RIPEstat only when an administrator explicitly clicks the link.<\/p>\n\n
RIPEstat: https:\/\/stat.ripe.net\/\nRIPE NCC Privacy Statement: https:\/\/www.ripe.net\/about-us\/legal\/ripe-ncc-privacy-statement\/<\/p>\n\n
Securizer stores settings, scan results and security logs locally in the WordPress installation. It does not include product telemetry or send Securizer usage statistics to the developer.<\/p>\n\n
Security logs may contain IP addresses and attempted usernames because they are required for login protection and security-event analysis. Securizer provides suggested text in the WordPress Privacy Policy Guide describing its local logging and relevant network behavior.<\/p>\n\n
Site administrators are responsible for retained security logs under applicable privacy requirements.<\/p>\n\n\n
A new installation stores conservative defaults and schedules a read-only Diagnostics and Core Integrity baseline. It does not repair files, rotate authentication salts, change the login URL or apply server-level file-protection rules.<\/p>\n\n\n
No. Securizer does not include a WAF or replace a server, CDN or dedicated firewall.<\/p><\/dd>\n
Securizer verifies WordPress core integrity against official checksums and can identify unexpected files in core directories. It is not a general-purpose malware scanner.<\/p><\/dd>\n
No. Securizer has no product telemetry or Securizer cloud service. Some features use official WordPress.org services, and some diagnostics request the site's own public URLs as documented above.<\/p><\/dd>\n
Safe Login URL verifies the new route before hiding normal anonymous login access, restores the previous configuration if verification fails, and provides an emergency recovery bypass.<\/p><\/dd>\n
Add this line to wp-config.php:<\/p>\n\n
define( 'WPPS_SECURITY_BYPASS', true );\n<\/code><\/pre>\n\nThis disables active Securizer protection modules while keeping the administration interface available. Remove the line after resolving the problem.<\/p><\/dd>\n
Does Securizer automatically repair or delete WordPress core files?<\/h3><\/dt>\nNo. Core Integrity scanning is read-only. An administrator can explicitly select modified or missing official core files and run Safe Repair; Securizer validates the matching official WordPress package and re-verifies checksums after replacement. Unexpected files are reported rather than deleted.<\/p><\/dd>\n
Will Securizer disable another security plugin?<\/h3><\/dt>\nNo. Securizer can detect known overlapping login-protection functionality and display a compatibility recommendation, but it does not automatically disable or reconfigure another plugin.<\/p><\/dd>\n
What happens when Securizer is deactivated or deleted?<\/h3><\/dt>\nDeactivation preserves Securizer settings, logs and managed file-protection rules. By default, uninstall also preserves stored data; administrators can explicitly enable database cleanup.<\/p><\/dd>\n\n<\/dl>\n\n\n
1.0.4<\/h4>\n\n\n- Corrected Core Integrity locale selection. When only en_US fallback checksums are available, verification is partial and Safe Repair is blocked for that result.<\/li>\n<\/ul>\n\n
1.0.3<\/h4>\n\n\n- Hardened Cloudflare client-IP detection.<\/li>\n
- Prevented Diagnostics warnings with repeated security headers.<\/li>\n
- Prevented event logging errors when WordPress temporarily uses a database prefix without the Securizer event table.<\/li>\n<\/ul>\n\n
1.0.2<\/h4>\n\n\n- WordPress.org review-compliance fixes for safer salt rotation, Safe Login URL styling, Safe Core Repair, uploads protection verification and runtime path compatibility.<\/li>\n<\/ul>","raw_excerpt":"Lightweight WordPress security, login protection, hardening, integrity and diagnostics without a firewall or cloud service.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/su.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/355017","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/su.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/su.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/su.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=355017"}],"author":[{"embeddable":true,"href":"https:\/\/su.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/wppodrska"}],"wp:attachment":[{"href":"https:\/\/su.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=355017"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/su.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=355017"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/su.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=355017"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/su.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=355017"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/su.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=355017"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/su.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=355017"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}