Security

Login protection: limit failed attempts per IP→

How the failed-attempt limit counts, when an IP address gets locked out and how to lift a lockout

Enable two-factor by email→

Code prompt after the password: enable globally, unlock per administrator and test the flow beforehand

Hardening: headers, file editor, request filter→

Which toggles the Hardening area offers and what each one changes in what gets delivered

Check core files against wordpress.org→

Checksum comparison for every file of the WordPress core and what changed, missing and unknown mean

Read and export the activity log→

Which events end up in the log table, how long they stay and how the CSV export works

Malware scan across wp-content→

Pattern search for web shells and obfuscated code, with clear limits and no automatic judgement

Moving the login URL: set up, verify, revert→

How to move the WordPress login to a path of your own, what Kakapo Security checks itself in the process and how to get back out.

Set up the file watcher→

How to create the confirmed baseline, read findings and set up the instant alert so that it actually gets read when it matters.