MJP Security Tools is a focused hardening plugin that does four things well:<\/p>\n\n
<script><\/code>, <iframe><\/code>, onclick<\/code>, javascript:<\/code> and other injection patterns<\/li>\n- POST Request Log<\/strong> \u2014 records all POST data (passwords masked) with IP, user agent, and URL for CSRF\/audit detection<\/li>\n
- Failed Login Log<\/strong> \u2014 tracks every failed login attempt with username, IP, and timestamp<\/li>\n
- File Permission Checker<\/strong> \u2014 verifies WordPress root files and directories have safe permissions, checks for missing
index.html<\/code> files and SVN working copies<\/li>\n<\/ul>\n\nWhat this plugin does NOT do<\/strong> (because WordPress core already handles it):<\/p>\n\n\n- SSL enforcement \u2014 use
FORCE_SSL_ADMIN<\/code> or let WordPress 5.7+ auto-redirect<\/li>\n- Password strength \u2014 WordPress core enforces strong passwords since 4.3<\/li>\n
- Login rate limiting \u2014 use a dedicated plugin like Limit Login Attempts Reloaded<\/li>\n
- Version number hiding \u2014 marginal benefit, not worth the complexity<\/li>\n<\/ul>\n\n
Upgrading from v1.x:<\/strong><\/p>\n\n\n- The admin page has moved from jQuery UI tabs to native WordPress nav tabs<\/li>\n
- SSL forcing, password enforcement, login throttling, version hiding, admin username changing, database prefix randomization, password reset, and .htaccess generation have been removed \u2014 WordPress core and dedicated security plugins handle these better<\/li>\n
- PHP sessions replaced with WP transients for flash messages<\/li>\n
- Log data is now stored as JSON instead of serialized PHP<\/li>\n
- The Javacrypt client-side crypt(3) script has been removed<\/li>\n<\/ul>\n\n\n
\n- Upload the
mjp-security-plugin<\/code> folder to \/wp-content\/plugins\/<\/code><\/li>\n- Activate through the Plugins menu<\/li>\n
- Go to Tools > MJP Security Tools<\/li>\n<\/ol>\n\n\n
\nWhat happened to all the other features?<\/h3><\/dt>\nWordPress 6.x handles SSL, password strength, and many security basics natively. Rather than duplicating core functionality, v2.0.0 focuses on the four features that WordPress does NOT provide out of the box: XSS scanning, POST logging, failed login logging, and file permission checking.<\/p><\/dd>\n
Is this a replacement for Wordfence\/iThemes?<\/h3><\/dt>\nNo \u2014 those are comprehensive security suites. MJP Security Tools is a lightweight auditing companion that provides specific database scanning and logging features.<\/p><\/dd>\n\n<\/dl>\n\n\n
2.0.0<\/h4>\n\n\n- Rewrite: focused on 4 core features \u2014 XSS scanner, POST log, failed login log, file permissions<\/li>\n
- Removed: SSL forcing, password enforcement, login throttling, version hiding (handled by WP core)<\/li>\n
- Removed: Admin username changer, DB prefix randomizer, password reset all users, .htaccess generator<\/li>\n
- Removed: jQuery UI 1.8.10 dependency and Javacrypt crypt(3) JavaScript (~500 lines)<\/li>\n
- Removed: PHP sessions \u2014 uses WP transients for flash messages<\/li>\n
- New: Native WordPress nav-tab interface (no jQuery UI)<\/li>\n
- New: Dedicated CSS\/JS assets instead of inline styles and CDN links<\/li>\n
- New: Clear log buttons for POST and failed login logs<\/li>\n
- New: Log data stored as JSON instead of serialized PHP<\/li>\n
- New: File permission scan limited to 2 levels deep (prevents timeout on large installs)<\/li>\n
- Fixed: HTML parse error in admin template (missing
><\/code> on div tag)<\/li>\n- Fixed: Admin page uses dedicated slug instead of
__FILE__<\/code><\/li>\n- Changed: Requires WordPress 6.0+<\/li>\n<\/ul>\n\n
1.2.1<\/h4>\n\n\n- Fixed PHP 8.1 deprecation: get_option() returning false passed to substr()<\/li>\n<\/ul>\n\n
1.2.0<\/h4>\n\n\n- PHP 8.x compatibility fixes<\/li>\n
- Replaced deprecated functions and constants<\/li>\n
- Tested with WP 6.9.1<\/li>\n<\/ul>\n\n
1.1<\/h4>\n\n\n- Tested in WP 3.3.2<\/li>\n<\/ul>\n\n
1.0<\/h4>\n\n\n- First Release<\/li>\n<\/ul>","raw_excerpt":"Lightweight WordPress hardening \u2014 XSS database scanner, POST request logging, failed login logging, and file permission checker.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/tah.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/8566","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tah.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/tah.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/tah.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=8566"}],"author":[{"embeddable":true,"href":"https:\/\/tah.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/zackdesign"}],"wp:attachment":[{"href":"https:\/\/tah.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=8566"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/tah.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=8566"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/tah.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=8566"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/tah.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=8566"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/tah.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=8566"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/tah.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=8566"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}