Vortix Web Security

Vortix Web Security provides practical WordPress hardening without accounts, license keys, remote telemetry or a license server. The plugin is designed to be conservative: new compatibility-sensitive protections are off by default, and .htaccess changes are verified and reverted if the site’s own loopback probe reports an HTTP 500.

Free protection modules

1. Basic Hardening – generic login errors, public username-enumeration protection and MIME-sniffing protection.
2. Login Protection – temporary IP and username lockouts after repeated failed logins.
3. Disable XML-RPC – disables the XML-RPC interface and related discovery links.
4. Bad Bot Blocker – blocks requests from a small list of known scanner/exploit User-Agents.
5. Upload Protection – blocks execution of common script files in the uploads directory on Apache/LiteSpeed.
6. Disable File Editor – disables the WordPress plugin and theme code editors.
7. Hide WP Version – removes common WordPress version disclosures.
8. Disable Directory Browsing – adds a verified Options -Indexes rule on Apache/LiteSpeed.
9. Strong Password Enforcement – requires stronger passwords for users who can publish content.
10. Automatic Plugin Updates – allows automatic updates for packages served by WordPress.org over HTTPS.
11. Automatic Theme Updates – allows automatic theme updates for packages served by WordPress.org over HTTPS.
12. Pingback & Trackback Control – disables legacy pingback/trackback publishing paths.
13. Safe Security Headers – adds conservative X-Content-Type-Options and Referrer-Policy headers.
14. Sensitive File Protection – blocks direct access to common deployment/configuration filenames and Git metadata directories.
15. Malicious Query Blocking – blocks a small set of high-confidence XSS, traversal, null-byte, webshell and SQL injection signatures in the query string.

A 20-point Security Scan provides local checks for HTTPS, XML-RPC state, debug mode, file permissions, upload protection, version exposure, administrator username, login protection, directory listing, user enumeration, REST user exposure, file editors, RSD/WLW links, outdated plugins, pingback/trackback control, security headers, sensitive-file protection and malicious-query protection. Checks that cannot be verified are reported as unknown and excluded from the score.

Compatibility-sensitive modules remain off by default, including XML-RPC blocking, bot blocking, .htaccess protections, automatic updates, pingback/trackback control and malicious-query blocking. Existing installations keep their current choices when updating; newly introduced 2.2.0 modules are not enabled automatically.

Login recovery

If Vortix Login Protection ever locks out an administrator, add this temporary line to wp-config.php:

define( 'VORTIX_DISABLE_LOGIN_PROTECTION', true );

Log in, remove the line, and then review the Login Protection settings. This bypass affects only Vortix’s lockout module.

Privacy

Blocked requests are logged locally in the site’s own database. The log contains the client IP address, request path without the query string, event type and time. Entries are automatically removed according to the configured retention period. Login-attempt counters use keyed hashes and expire automatically.

The plugin does not send telemetry, security logs, license data or scan results to the author or another server.

External services

Vortix Web Security does not contact an external service.

• Security Scan and .htaccess safety checks may make loopback requests to the site’s own URL.
• Cloudflare mode only reads the CF-Connecting-IP request header and uses address ranges bundled with the plugin; it does not contact Cloudflare.
• The optional Premium link is an ordinary user-initiated external link. No request is made by the plugin merely because the link is displayed.