Open24 Security

Open24 Security applies a set of well-known hardening measures to WordPress and WooCommerce sites from a single settings screen. Every option is off by default and can be switched on individually, so you decide exactly how much you want to restrict.

The plugin does not require an account. A few optional features contact external services, and only once you turn them on: see External services below.

Features

WordPress REST API

• Hide the /wp-json/wp/v2/users endpoint
• Require authentication on sensitive endpoints
• Disable the /wp-json/ index

Login

• Custom login URL (replace wp-login.php with your own slug)
• Limit login attempts per IP address
• Block common usernames such as admin or root
• Hide error hints that reveal whether a username exists

Protocols

• Disable XML-RPC
• Block external access to wp-cron.php
• Block user enumeration via ?author=N

Information disclosure

• Hide the WordPress version from the generator meta tag and RSS feeds

PHP version

• Shows the PHP version the server runs and whether it has known security flaws, such as the “php2shell” remote code execution flaws (CVE-2026-109618 and CVE-2026-109619) fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or a branch that no longer receives security fixes
• Flags session.upload_progress.enabled, which PHP recommends turning off until CVE-2026-115560 is fixed
• Optional: a notice for administrators across the admin, a Site Health check and a daily alert email. No external service is contacted: the list of fixed versions ships with the plugin

HTTP security headers

• X-Frame-Options, X-Content-Type-Options, Referrer-Policy
• Permissions-Policy, X-XSS-Protection
• Optional HSTS

Administrator accounts

These limit the damage when someone signs in with a valid password, which is how most stores get compromised: stolen or reused credentials. They apply to administrators and WooCommerce shop managers.

• Block the theme and plugin file editor (same effect as DISALLOW_FILE_EDIT, without touching wp-config.php)
• Block installing and uploading plugins and themes, while updates keep working
• Disable application passwords, which sign in through the API and skip the login screen
• Limit how long an administrator session lasts, including sessions that were already open
• Only allow administrators from a list of IPs or ranges. A correct password from any other network gets the same error as a wrong one, and an alert is sent
• Reject leaked passwords for administrator accounts, checked against Have I Been Pwned
• See every open administrator session, with IP and browser, and close them

Alerts and activity log

• Email alerts when an administrator signs in from a new IP or with something that is not a web browser
• Email alerts on sensitive actions: plugins or themes installed, activated, deactivated or deleted, files saved from the admin editor, new administrator accounts or role changes, and changes to these settings
• Activity log of those actions with IP and user agent

File integrity

• Daily check of every WordPress core file against the official checksums, including files that should not be there
• Same check for plugins from wordpress.org
• Change watch for themes, mu-plugins, drop-ins and other plugins, against a snapshot
• Email alert when something does not match, and a button to run the check on demand

Content-Security-Policy

• Configurable CSP for the storefront, in report-only mode first. Reports are collected and shown in the settings screen, so you can build the list of domains the site really uses before enforcing it. Once enforced, a card skimmer cannot send stolen data to a domain that is not on the list.

WooCommerce

• Reject anonymous requests to the /wc/v3/ and /wc/v2/ REST routes
• Hide WooCommerce headers on the storefront

Tools

• Log out all users: rotates the WordPress security keys and salts, which invalidates every session cookie and immediately signs out all logged-in users. Useful after a suspected compromise or when an employee leaves.
• Change log: records which settings were changed and when.
• Settings lock: with define('O24S_LOCK_SETTINGS', true); in wp-config.php the settings cannot be changed from the admin, so someone who gets into an administrator account cannot switch the protections off from there.

Agency signature

• Adds an Open24 signature in the document head so the site can be identified as maintained by the agency by crawlers such as BuiltWith. This can be turned off.

About the security keys feature

Rotating the WordPress security keys requires updating the corresponding constants in wp-config.php. The plugin does this through the official WP_Filesystem API, writes to a temporary file with restrictive permissions and then moves it over the original in a single atomic operation, preserving the original file permissions. No backup copy is left anywhere on the server, and if any step fails, wp-config.php is left untouched.

If wp-config.php is not writable, the feature reports it and makes no changes.

External services

These features send requests to services outside your site. All of them are off by default.

• Log out all users requests new security keys from the WordPress.org secret key API (https://api.wordpress.org/secret-key/1.1/salt/) when you press the button. Nothing about your site is sent. WordPress.org privacy policy.
• Check WordPress core files requests the official checksums for your WordPress version and language from https://api.wordpress.org/core/checksums/1.0/ once a day. The request contains the WordPress version and locale. WordPress.org privacy policy.
• Check plugins from wordpress.org requests the official checksums of each installed plugin version from https://downloads.wordpress.org/plugin-checksums/. The request contains the plugin folder name and version; results are cached for a week. WordPress.org privacy policy.
• Reject leaked passwords sends the first 5 characters of the SHA-1 hash of an administrator’s password to the Have I Been Pwned Pwned Passwords API (https://api.pwnedpasswords.com/range/) when the password is set, or the first time it is used to sign in. The password and its full hash never leave the site, and the response is padded so its size does not reveal anything either. Have I Been Pwned privacy policy.

The Content-Security-Policy reports are sent by your visitors’ browsers to your own site, not to a third party.