H3SEC Guard – Security Hardening

H3SEC Guard is built for site owners who want practical security controls without enabling a heavy, opaque security suite.
Project contact: h3st4k3r@h3sec.com

Main capabilities:

• Hardening controls (XML-RPC, file editor, author enumeration, security headers)
• Login protection (attempt limit + temporary IP lockout + optional admin whitelist)
• Activity logging for critical site changes
• Core integrity scan using official WordPress checksums
• Lightweight suspicious PHP scanner with context-aware severity
• Finding-level hashes (MD5/SHA256), full path visibility, and recommendations
• Risk panel (low / medium / high / critical score)
• On-screen findings tables (not only downloads) for suspicious files, core mismatches, and permissions
• Response mode actions (close sessions, force password reset, maintenance, forensic export)
• Default blocking for known malicious probe paths with temporary IP lockout
• Conservative trusted-proxy and IPv4/IPv6 CIDR resolution, including optional Cloudflare forwarding
• Monitor, balanced, and strict public POST inspection with route exclusions and bounded body size
• Read-only server configuration inspection, with explicit atomic creation only for missing Apache/LiteSpeed files
• Safe robots.txt inspection and explicit creation without modifying existing files
• Quick/deep scan modes, bounded findings, exclusions, symlink avoidance, and checksum-unavailable reporting
• Weekly mitigation report with detailed activity counters
• Tracking for attempts with non-existent usernames
• Paginated activity log with expandable event context
• Configurable log retention with automatic daily cleanup
• Local security assistant with explainable next-step guidance
• Branded HTML weekly reports and security alerts
• No hidden telemetry or mandatory third-party APIs

H3SEC Guard is designed as an explainable security plugin. Each control explains:

• what it does,
• what risk it reduces,
• what it may break,
• how to revert it.

1. In wp-admin, open Plugins > Add New > Upload Plugin.
2. Upload the H3SEC Guard ZIP and activate it.
3. Open H3SEC Guard in wp-admin.
4. Review the explainable controls, save settings, and run a Quick or Deep scan.

1. 

   Risk panel, assistant, and weekly mitigation summary.

2. 

   Finding-level scan results with file paths and hashes.

3. 

   Activity log with pagination and expandable context.

1.2.0

• Promoted the current stable feature set to the 1.2.0 release line.
• Includes the hardened dashboard bootstrap and read-only server detection introduced in the 1.1.x maintenance releases.

1.1.7

• Fixed the admin dashboard fatal error caused by missing web server detection.
• Added conservative Apache, LiteSpeed, Nginx, IIS, and unknown server detection for read-only configuration guidance.

1.1.6

• Fixed dashboard loading when the activity table returns no rows or a database read fails.
• Added a direct Settings link to the plugin action row.
• Hardened first-run scheduling and activation compatibility.

1.1.5

• Added a local update status panel that uses WordPress.org’s normal update cache without a custom ping or forced update.

1.1.4

• Added safe robots.txt and server configuration inspection with explicit atomic creation.
• Added maintenance recovery paths, trusted proxy/CIDR IP resolution, and optional Cloudflare forwarding.
• Added monitor/balanced/strict POST inspection with exclusions and fingerprint-only logging.
• Added bounded event deduplication, repeat counts, weekly rollover, retention batches, and category-based alerts.
• Added shared branded HTML email template, marked test email, and privacy-focused data handling.
• Added Quick/Deep scanner coverage, safe exclusions, symlink avoidance, and checksum availability distinction.
• Separated configuration posture risk from threat activity and sorted assistant recommendations deterministically.

1.1.3

• Added paginated activity events with total counts and expandable context.
• Added configurable log retention and automatic daily cleanup.
• Added a local explainable security assistant to prioritise improvements.
• Improved weekly and alert emails with H3SEC HTML branding and readable tables.
• Removed development-only test files from the published plugin package.

1.1.2

• Updated tested WordPress version compatibility header.

1.1.1

• Improved path resolution for core, admin, includes, content, plugins and uploads directories to better support custom WordPress installations.

1.1.0

• Added weekly mitigation report panel and scheduled weekly email summary.
• Added counters for vulnerable PHP probe tests, forbidden URL requests, form denials, XML-RPC denials, REST API denials, and blocked IPs.
• Added tracking for attempts with non-existent usernames.
• Added optional restrictions for sensitive REST API endpoints and suspicious public POST payloads.

1.0.0

• Initial release.
• Hardening controls and explainable settings.
• Login protection and response actions.
• Activity log with CSV/JSON export.
• Core integrity + suspicious pattern scanner.
• Risk panel and forensic JSON package export.
• Added finding-level hashes, in-dashboard scan result tables, and suggested improvement plan.
• Added known probe-path blocking and temporary lockout for repeated suspicious requests.