Securizer is a lightweight WordPress security and diagnostics plugin focused on local protection, verification and reporting. It provides login protection, hardening, core integrity, Safe Repair, diagnostics and account hygiene without a Securizer cloud service.
Read-only checks do not repair files. Disruptive actions require administrator confirmation; safety-sensitive workflows use verification and rollback.
Login Protection
- Progressive IP lockouts for repeated failed login attempts
- Targeted-account activity detection
- Exact-IP whitelist and blacklist
- Active lockout management and manual unlock
- Security event logging
- Configurable client IP detection, including Cloudflare support
- Compatibility warnings for overlapping login-protection plugins
Safe Login URL
Securizer can provide a custom login path and hide normal anonymous access to wp-login.php and wp-admin. The new route is verified before the default route is hidden, and the previous configuration is restored if verification fails. An emergency recovery constant is available if access problems occur.
WordPress Hardening
Hardening controls cover XML-RPC and pingbacks, generator exposure, author enumeration, REST API user exposure, the file editor, Application Passwords, security headers, directory listing and public access to PHP-like files inside uploads. Potentially incompatible server-level changes are not forced automatically.
Core Integrity and Safe Repair
Core Integrity compares WordPress core files with official checksums and identifies modified files, missing official files and unexpected files inside wp-admin and wp-includes.
Scanning is read-only. For selected modified or missing files, Safe Repair downloads the matching official WordPress package, reads only selected files into memory, verifies checksums, writes them through the WordPress Filesystem API and scans again. Pre-repair contents remain in memory for rollback if verification fails. Unexpected files are reported and not deleted.
Diagnostics and Safe File Protection
Diagnostics checks security configuration, public exposure, HTTPS/SSL behavior, headers, file/directory protection and WordPress configuration. Some checks request the site’s public URLs to verify effective behavior.
Safe File Protection can verify directory listing and denial of PHP-like requests in uploads. Its uploads test requests a randomized, non-existent PHP-like URL and creates no probe file. Where supported, Securizer can apply its own marked rules, verify the result immediately and roll back a newly applied rule when it cannot confirm a safe and effective change.
Account Hygiene, Salts and Logs
Account Hygiene reviews administrator usernames, active sessions and Application Passwords, and includes a controlled administrator login-name change workflow. Securizer also audits the eight WordPress authentication keys and salts without displaying or storing their values; explicit rotation includes verification and rollback.
Security events are stored locally and can include IP address, attempted username, event type, timestamp and limited event context. Passwords and authentication secrets are never logged. Logs can be reviewed in WordPress administration and exported as CSV.
What Securizer is not
Securizer is not a WAF, cloud malware scanner or vulnerability-intelligence service. It does not replace secure hosting, backups, updates or a dedicated firewall where required.
External services and network requests
Securizer has no product telemetry and does not require a Securizer cloud account.
WordPress.org services
Core Integrity requests official checksums from WordPress.org. When an administrator explicitly runs Safe Repair, Securizer also downloads the matching official WordPress release package and reads only selected repair files from the archive in memory.
These requests send the WordPress core version and locale needed for checksum verification or package selection.
WordPress.org: https://wordpress.org/
WordPress.org Privacy Policy: https://wordpress.org/about/privacy/
Requests to the site’s own public URLs
Diagnostics, Safe Login URL verification and Safe File Protection can request URLs belonging to the same site to verify redirects, login-route behavior, headers, public exposure and file protection. No Securizer cloud service is involved.
RIPEstat
Security Logs can display a manual Lookup link for eligible public IP addresses. An IP address is opened on RIPEstat only when an administrator explicitly clicks the link.
RIPEstat: https://stat.ripe.net/
RIPE NCC Privacy Statement: https://www.ripe.net/about-us/legal/ripe-ncc-privacy-statement/
Privacy
Securizer stores settings, scan results and security logs locally in the WordPress installation. It does not include product telemetry or send Securizer usage statistics to the developer.
Security logs may contain IP addresses and attempted usernames because they are required for login protection and security-event analysis. Securizer provides suggested text in the WordPress Privacy Policy Guide describing its local logging and relevant network behavior.
Site administrators are responsible for retained security logs under applicable privacy requirements.
Screenshots
Dashboard with protection status, recent activity, Action Center, compatibility checks and security overview.
Login Protection with IP handling, targeted-account monitoring, active lockouts and Safe Login URL.
Hardening controls for exposure reduction, remote access and browser security headers.
Administrative hardening, Authentication Keys & Salts rotation, and Safe File Protection.
Core Integrity verification against official WordPress checksums.
Diagnostics / Self Test with update hygiene and security configuration checks.