1. Install and activate
In WordPress go to Plugins → Add new → Upload plugin, choose the plugin zip and activate it. A «Hardening» item appears in the menu, opened on the Status tab. All switches are off: the site is exactly as before.
2. Read the Status tab
The red and yellow rows tell you what is missing and where to fix it. Some are solved with a plugin switch; others (HTTPS, an administrator named «admin», the PHP version, file permissions) are fixed in WordPress or in the hosting, and the tab tells you how.
3. Apply the recommended settings
One button turns on the protections suited to almost every site. Then review the others: XML-RPC if you use Jetpack, private REST API if the site has forms or a shop, comments if you use them. Every switch tells you what changes before you turn it on.
4. Turn on the second factor
From your profile: scan the QR code with the app, enter the first code and save the ten emergency codes. The other administrators have the grace period to do the same; those who don't can only open their profile once it expires, until they complete activation.
5. Check Server, Log and Notifications
In the Server tab, look at the headers panel and the preview of the .htaccess rules, then save: the plugin checks them with requests to the site. Turn on the log and choose the events to receive by email, with the test email to check that they arrive.
6. Keep the settings
In the Tools tab, download the JSON file with all the settings and keep it with your backups. On another site upload it, read the preview of what changes and import: the site-specific settings (proxy and addresses) stay out until you tick them yourself.
wp-config.php: the ways out and the secrets key
// Suspends the IP lockouts
define( 'LOBBIT_HARDENING_NO_LOCKOUT', true );
// Suspends the second factor
define( 'LOBBIT_HARDENING_NO_TWO_FACTOR', true );
// No writing of the .htaccess files (the rules are shown to copy by hand)
define( 'LOBBIT_HARDENING_NO_HTACCESS', true );
// Own key for the secrets of the second factor, to set before the users enable it
define( 'LOBBIT_HARDENING_KEY', '...' );
WP-CLI: a user's second factor, the settings
wp lobbit-hardening two-factor status <user>
wp lobbit-hardening two-factor reset <user>
wp lobbit-hardening settings export lobbit-hardening.json
wp lobbit-hardening settings import lobbit-hardening.json --dry-run
PHP: a second factor plugin that the plugin does not know
add_filter( 'lobbit_hardening_two_factor_plugins', function ( $found, $active ) {
if ( in_array( 'my-2fa/my-2fa.php', $active, true ) ) {
$found['my-2fa/my-2fa.php'] = 'My 2FA';
}
return $found;
}, 10, 2 );
PHP: the visitor's address, for hosting that the settings do not cover
add_filter( 'lobbit_hardening_client_ip', function ( $ip ) {
// Only when every request really comes through that proxy
return $_SERVER['HTTP_X_REAL_IP'] ?? $ip;
} );
Another filter: lobbit_hardening_two_factor_api_login, to decide which program-based logins (XML-RPC, REST API) have no page for the code. On nginx the Server tab shows the location blocks to copy into the server configuration.
