The usual routes are well known: XML-RPC, usernames, the file editor, the login form. Kakapo Security closes them — and tells you if something in the core changes anyway.
| Check | State |
|---|---|
| Failed logins limitedAfter 5 failed attempts, it locks out. | ok |
| Core integrity cleanAll checked core files match wordpress.org. | ok |
| WordPress core up to dateA WordPress core update is available. Recommendation: install the pending core update. | critical |
| Security headers setNo security headers active. Recommendation: switch on the security headers under “Hardening” (in German: „Härtung“). | open |
| No suspicious filesThe last scan found no suspicious patterns. | ok |
Too many failed attempts from one IP? Past the limit you set, it's over for a while.
Learn more →A code prompt at login — globally or only for the accounts that really need it.
Learn more →XML-RPC off, user list closed, file editor locked. Three toggles, three surfaces fewer.
Learn more →Requests with known attack patterns never reach WordPress. Scanner bots don't either, if you want.
Learn more →The core is held against the real checksums from WordPress.org. Every deviation is reported.
Learn more →Looks for suspicious patterns in the files and names every find with path and line.
Learn more →Logins and failed attempts · Blocked IP addresses
Learn more →Blocks SQL injection patterns · Detects XSS, ../ and php://
Learn more →Alert when an IP is blocked · Notice about changed core files
Learn more →Checksums straight from WordPress.org · No comparison list of our own
Learn more →Checksum per file · changed, new or missing compared with the confirmed baseline
Learn more →Your own path instead of wp-login.php · Test request before the switch
Learn more →XML-RPC can be switched off · Author query ?author= is redirected
Learn more →IP lockout after too many failed attempts · attempts and lockout duration configurable
Learn more →Searches the files of the installation · Looks for suspicious patterns
Learn more →X-Frame-Options against embedding by others · nosniff against MIME guessing
Learn more →Code prompt after the password · Can be enabled globally for all users
Learn more →All eight plugins in the “Das Nest” bundle — Analytics, Consent, Backup, Performance, SEO, Security, Roles and Media. Every future plugin is included at no extra charge.
Instead of €13 a month — after just under a year you pay nothing more.
This offer ends soon.
Get LifetimeSecure payment via Stripe · First 14 days: problem fixed or your money back
