INI Protector

INI Protector is a focused, no-bloat hardening plugin for WordPress. Every feature
is an independent toggle, grouped into three areas:

Security

• File integrity monitoring — hashes every code file (.php, .php5, .phtml,
  .phar, .js, .htaccess, .user.ini …), keeps a baseline, and re-checks on a
  schedule. Any file that is added, changed, or deleted is emailed to you (and
  optionally POSTed to a webhook) before the baseline is updated, so the
  evidence has already left the server even if the site itself is compromised.
  Media is never hashed, but uploads, caches and backup folders are still checked
  for executable files — a .php among your images has no innocent explanation and
  is reported as critical. Runs from WP-Cron or from system cron via
  wp secwp integrity scan.
• Two-factor authentication (TOTP) — a time-based one-time code from any
  standard authenticator app, required per role. The password is verified first,
  then the code, before any session cookie is issued. Recovery codes are issued
  at setup, and wp secwp 2fa reset <user> restores access from the shell.
• Disable XML-RPC, disable the theme/plugin file editor, require login for the
  REST API.
• Limit login attempts (IP lockout), mask the login URL to a secret slug.
• Password-protect the whole front-end.
• Disable comments and pingbacks/trackbacks.
• Prevent user enumeration and information disclosure (directory listing,
  wp-config/.htaccess/backup/log access; Apache .htaccess rules or an Nginx
  snippet).
• Hardening HTTP security headers (X-Frame-Options, X-Content-Type-Options,
  Referrer-Policy, Permissions-Policy).
• ALTCHA proof-of-work login captcha (self-hosted, no third-party calls).
• Traffic monitor — records incoming requests so suspicious activity is visible,
  with a per-IP drill-down. Keeps the full history by default; you can cap it by
  age, by number of requests, or both.
• Auto-block escalation — a dedicated IP Block page that surfaces the
  traffic monitor’s suggested blocks for one-click review (Block Suggestion
  System), and an optional Auto-Block mode that blocks offending IPs
  automatically on an escalating temporary schedule (1h → 4h → 8h → 5 days →
  2 weeks). Never issues a permanent block automatically; an allowlist and
  verified search-engine bots are always exempt; quiet IPs decay back down.
• Vulnerability scan — a daily check of your installed plugins, themes, and
  WordPress core against the free WPVulnerability database (CC0, no API key).
  Findings appear on a dedicated page and on the dashboard, with an optional
  email alert on new findings. No data about your site is sent — only the
  public slug of each component is looked up.

Head cleanup

• Remove the generator/RSD/WLW/shortlink tags, strip or mask asset version
  query strings, drop front-end Dashicons.

Utilities

• Rotate asset cache token — changes the version token on every CSS and JS
  URL at once, so returning visitors re-fetch them. Use it after a deploy when
  a file has changed but the version it declares has not. Available from
  INI Protector → Utilities and from wp secwp asset-salt rotate, which is
  where it belongs in a deploy script.

SEO & privacy

• Disable feeds, disable author archives, obfuscate author slugs, and protect
  email addresses from harvesting.

INI WP platform

• Exposes a read-only, HMAC-signed REST endpoint (secwp/v1/state) so the
  INI WP control panel can pull this site’s security posture and scan results.
  The endpoint only activates when the INI WP connector is installed and
  configured; auth reuses the connector’s signed channel.

Notes

• Head cleanup lives here, not in SeoWP — SeoWP keeps pure SEO concerns
  (titles, meta, schema, noindex directives).

• Behind a reverse proxy or CDN, tell INI Protector which addresses your proxy
  uses so it can read the real visitor IP safely:

  define( ‘SECWP_TRUSTED_PROXIES’, ‘173.245.48.0/20, 2400:cb00::/32’ );

  Forwarded headers (X-Forwarded-For, CF-Connecting-IP) are then read only when
  the connection actually comes from one of those addresses — so a visitor who
  reaches your origin directly cannot claim to be someone else, evade an IP
  block, or get an innocent IP blocked. Without this, client IPs come from the
  socket peer, which cannot be forged. Security → Scan reports which mode you
  are in. The older SECWP_TRUST_PROXY constant still works but cannot check who
  sent the header; replace it when you can.

External services

The optional vulnerability scanner contacts WPVulnerability (https://www.wpvulnerability.com/)
only when you enable Vulnerability Scan. It sends installed plugin/theme slugs
and the WordPress core version to https://www.wpvulnerability.net/ to retrieve
known vulnerabilities. The service also receives the server IP address as part
of the connection. No site URL is included in the plugin’s user agent.
Service and privacy information: https://www.wpvulnerability.com/privacy/

File integrity webhooks are optional. When you configure a webhook URL and enable
alerts, reports containing the site URL, changed file paths, hashes and scan
metadata are sent to that URL. Configure only a recipient you trust; its terms
and privacy policy apply. Email alerts use your site’s configured mail service.

The optional INI WP connector allows your configured control panel to retrieve
security settings and scan results through an authenticated REST endpoint.
INI Protector does not initiate control-panel requests. Service information:
https://iniwp.com

Source code

The bundled ALTCHA widget is version 2.3.0, licensed under MIT.
Source: https://github.com/altcha-org/altcha/tree/v2.3.0
Build instructions are in that project’s README and package.json.
The widget runs locally in the browser; no ALTCHA service account is required.