Log in Try for free

Kakapo Security

Make life uncomfortable for attackers.

The usual routes are well known: XML-RPC, usernames, the file editor, the login form. Kakapo Security closes them — and tells you if something in the core changes anyway.

Try for free Pricing

Security · Overview● Rating: good

Score

87/100

good

Open items

2

to improve

Blocked IPs

3

up to date

Check	State
Failed logins limitedAfter 5 failed attempts, it locks out.	ok
Core integrity cleanAll checked core files match wordpress.org.	ok
WordPress core up to dateA WordPress core update is available. Recommendation: install the pending core update.	critical
Security headers setNo security headers active. Recommendation: switch on the security headers under “Hardening”.	open
No suspicious filesThe last scan found no suspicious patterns.	ok

Features

Close it first, then take a look.

Login protection

Too many failed attempts from one IP? Past the limit you set, it's over for a while.

Two-factor

A code prompt at login — globally or only for the accounts that really need it.

Hardening

XML-RPC off, user list closed, file editor locked. Three toggles, three surfaces fewer.

Bad request filter

Requests with known attack patterns never reach WordPress. Scanner bots don't either, if you want.

File integrity

The core is held against the real checksums from WordPress.org. Every deviation is reported.

Malware scan

Looks for suspicious patterns in the files and names every find with path and line.

Complete

Every feature — explained.

11 features, each with its own detail page.

Activity log

Logins and failed attempts · Blocked IP addresses

Bad request filter

Blocks SQL injection patterns · Detects XSS, ../ and php://

Notifications

Alert when an IP is blocked · Notice about changed core files

File integrity

Checksums straight from WordPress.org · No comparison list of our own

File watcher

Checksum per file · changed, new or missing compared with the confirmed baseline

Your own login URL

Your own path instead of wp-login.php · Test request before the switch

Hardening

XML-RPC can be switched off · Author query ?author= is redirected

Login protection

IP lockout after too many failed attempts · attempts and lockout duration configurable

Malware scan

Searches the files of the installation · Looks for suspicious patterns

Security headers

X-Frame-Options against embedding by others · nosniff against MIME guessing

Two-factor

Code prompt after the password · Can be enabled globally for all users

Ready?

Try Security for free.

24 hours free, no credit card required.