Everything here is off until you turn it on. Protection you did not choose is how plugins lock people out of their own sites. Turn each switch on when you are ready, and add your own IP to the firewall’s allowed list before enabling it.
General
MetaWrench → Security → General
The three hardening jobs every WordPress site needs and almost never gets: locking out addresses that keep failing to log in, stopping PHP from running inside the uploads folder, and sending the HTTP headers that stop your pages being framed or sniffed. Plus a list of recent failed logins and current lockouts.
Settings
- Enable login protection
- After a set number of failed login attempts from one IP address, that address is blocked from the login page for a set time. Lockout rules: attempts allowed (default 5, range 1–100) and lockout length in minutes (default 30, up to 1440). The lockout applies to the login form only; the rest of the site stays reachable.
- Enable file protection
- Blocks PHP execution in
wp-content/uploadsso a malicious file uploaded through a form cannot run; turns off directory browsing so visitors cannot list your folders; and removes the WordPress version number from the page head so scanners cannot target known-version exploits. - Enable security headers
- Sends X-Frame-Options (stops other sites framing yours), X-Content-Type-Options (stops browsers guessing file types) and Referrer-Policy (limits what other sites learn about where visitors came from). Safe defaults that do not break embeds.
- Restrict camera, microphone and location access
- Adds a Permissions-Policy header that stops third-party scripts using device features. Does not affect Google, maps, or local SEO. Off by default; turn on if you do not embed anything that needs those.
- Recent failed login attempts
- Press Show for the list: time, IP address, username tried. Above it, any addresses currently locked out with the time the lockout ends, and a Clear all lockouts button.
When something looks wrong
- I locked myself out
- Wait for the lockout period to end, or from another network (your phone’s data) log in and press Clear all lockouts. If you cannot wait, your host’s database tool can clear the
mw_lockoutsentries. - A legitimate user keeps getting locked out
- They share an IP with others (an office, a VPN). Raise the attempts allowed, or shorten the lockout, or have them use a password manager so they stop failing.
- An upload stopped working after file protection
- It is trying to run PHP from uploads, which is exactly what the switch blocks. That is a badly written plugin; report it to its author, or turn file protection off and accept the risk.
- An embedded map or video disappeared
- Turn off Restrict camera, microphone and location. Some embeds request those permissions even though they do not use them, and refuse to load when denied.
- The failed-login list is hundreds of entries a day
- Normal for any WordPress site. Turn on login protection and the firewall; the list shrinks as repeat offenders are blocked before they reach the form.
Related: Firewall · CSS / JS / HTML
Firewall
MetaWrench → Security → Firewall
Turns away the automated traffic that hits every WordPress site — vulnerability scanners, injection attempts, floods — before it reaches your theme or plugins. It never runs inside WordPress admin, so it cannot lock you out of your own dashboard. Every block is logged with the reason.
Settings
- Enable firewall
- The master switch. Changes take effect immediately after saving.
- Block known scanner tools
- Rejects requests from tools like sqlmap, nikto and nmap, identified by how they announce themselves. These have no legitimate reason to visit a business website.
- Block suspicious request patterns
- Rejects addresses containing common attack patterns: SQL injection, script injection, path traversal. A real visitor never types these.
- Limit requests per minute
- Temporarily blocks an address that asks for too many pages too quickly. Max requests per minute defaults to 120; a human browsing never gets near it, a scraper does in seconds.
- Blocked IPs
- Addresses you have blocked by hand, with the reason. Block IP adds one; Unblock removes it.
- Allowed IPs
- Addresses that always get through even if a rule would block them. Add your own IP here before enabling the firewall, and any service that legitimately hits your site hard, such as an uptime monitor.
- Firewall activity
- The most recent blocked requests: time, IP, reason.
When something looks wrong
- A real visitor was blocked
- Find them in Firewall activity, note the reason, and add their IP to Allowed IPs. If the reason was the rate limit, raise Max requests per minute.
- My uptime monitor or backup service is being blocked
- Add its IP addresses to Allowed IPs. Most services publish their ranges.
- Cloudflare is in front of the site and every request shows the same IP
- The firewall sees Cloudflare’s address instead of the visitor’s, so one block can affect everyone. Ask your host to enable Cloudflare’s real-IP restoration, or use Cloudflare’s own firewall rules instead and turn this one off.
- Page speed dropped after enabling
- It should not; the checks are cheap. If it did, another security plugin is also inspecting every request. Run one, not two.
- I want to block a whole country
- Not a feature. Cloudflare’s free plan does this at DNS level.
Related: General · 404 monitoring
Malware
MetaWrench → Security → Malware
Two scans that together cover where malware hides. Scan Files compares WordPress core against the official checksums and looks through themes and plugins for backdoors, webshells and obfuscated code. Scan Database checks posts, options and comments for injected links, hidden iframes and redirect scripts. Run both for a complete picture. Anything found can be repaired, reinstalled, quarantined or marked safe, and scans can run on a schedule with an email only if something is found.
Settings
- Run Full Scan
- Runs both scans. Takes a minute or two; longer on a site with many plugins. Last scanned shows when.
- Repair File
- For a modified core file: replaces it with the official copy.
- Reinstall Plugin
- For a modified plugin file: reinstalls that plugin from the WordPress repository. Settings are kept.
- Quarantine
- Moves the file out of the web root so it cannot run, without deleting it. The Quarantine list below shows what is there; review and delete permanently once you are sure.
- Mark as Safe
- For a plugin you installed and trust that uses encoded code. The whole plugin folder is excluded from future scans. The Plugins Marked as Safe list lets you remove it again.
- Scheduled Scans
- Off, Daily, Weekly or Monthly. Runs both scans. An email goes to the site admin address only if something critical is found. Run scheduled scan now tests it.
When something looks wrong
- A plugin is flagged for obfuscated code
- Some commercial plugins encode their source. If you installed it from a reputable vendor, Mark as Safe. If you do not recognise it, Quarantine it and see whether the site still works.
- A core file is flagged as modified
- Press Repair File. Core files should never be edited; if one is, either a previous developer customised it or something injected into it. Repair is safe either way.
- The database scan found a record
- It shows the table, row, column and the threat. Open that record in WordPress (a post, an option, a comment) and remove the injected content. If it is in an option you do not recognise, search the name; it is usually from a plugin, and if that plugin is gone, delete the option.
- Quarantining a file broke the site
- The file was needed. Restore it from the Quarantine list. Then work out why a needed file looked like malware: usually an encoded commercial plugin, which you then Mark as Safe.
- The scan finds nothing but the site is still redirecting visitors
- Check the database scan ran, not just files. If both are clear, the redirect may be in the .htaccess file, a theme option, or the host’s own configuration; ask your host to check.