YuraCode Security
Free · Zero-config

The WordPress security plugin that just works

Zero-config hardening, login protection, and an Apache .htaccess firewall (8G ruleset). Active the moment you install, with no external calls.

What it does

Zero-config hardening

Hardened the moment you activate:

  • Disable XML-RPC, emojis, self-pingbacks, application passwords and AI prompts
  • Hide the WordPress version, generic login errors
  • Restrict the REST API to logged-in users
  • Disable comments site-wide, keeping existing content

Login protection

Brute-force protection, no game of whack-a-mole:

  • Failed attempts tracked per IP address
  • Maximum attempts before lockout (default 5)
  • Configurable lockout duration (default 15 minutes)

Apache .htaccess firewall (8G)

The 8G ruleset by Perishable Press, before WordPress even loads:

  • Toggleable categories: query strings, URIs, user agents, referrers, cookies, methods
  • Protect wp-config.php and sensitive files
  • Block direct access to wp-includes and PHP execution in uploads

How it works

1

Install

Install the plugin and activate it.

2

Protected

Hardening is active immediately, the firewall block is written to .htaccess.

3

Tune if you like

Everything lives on one screen: Settings → YuraCode Security.

FAQ

Does the plugin make any external calls?

No. Everything runs on your server — no callbacks, no phone-home.

I'm on nginx or IIS. Does it still work?

Hardening and login protection work on any server. The Apache firewall is detected automatically and skipped with an admin notice.

Will the firewall conflict with my existing .htaccess?

No. Rules live between their own markers, with a backup written before every change — and they're removed cleanly on deactivation.