Login protection with 2FA and attempt limits
Security Optimizer combines several login barriers to help limit brute-force attempts.
Two-factor authentication (2FA) requires admin users to enter a token generated through Google Authenticator. You can also change the login and sign-up URLs, restrict login access by IP address or range, and prevent the creation of common usernames; existing weak usernames prompt a request to replace them.
Login attempt limits block an IP address after it reaches the configured threshold: the first block lasts one hour, with longer restrictions of 24 hours and then a week for persistent failures. Sites with strict access needs can add IP restrictions, but should ensure legitimate administrators can still reach the login page.
Hardening WordPress files and site settings
The hardening controls address file execution, information exposure and several site functions.
- System-folder protection prevents unauthorized or malicious scripts from running in protected system folders.
- Advanced XSS Protection adds a defense against cross-site scripting attacks.
- Admin editor controls disable the themes and plugins editor, reducing the chance of unauthorized changes or coding errors through WordPress.
- Version and readme cleanup hides the WordPress version and deletes the default readme file, reducing exposed information that may help attackers identify targets.
- XML-RPC can be disabled to reduce exposure to attacks, but this restricts communication with third-party systems; leave it enabled if those connections are needed.
- RSS and ATOM feeds can be disabled to reduce content scraping and certain attacks, but doing so cuts off readers who access the site through feed readers.
Activity logs and weekly security reports
Security Optimizer provides visibility into visitor activity and blocked attempts.
The Activity Log shows activity from registered, unknown and blocked visitors, with tools to block future attempts. This gives site administrators a place to review suspicious behavior and take action when an account or site component may be compromised.
Weekly email reports summarize bot and human traffic, along with blocked login and visit attempts. They can help administrators spot changes in traffic or attack attempts without checking the log continuously.
A broad free toolkit backed by active support
Security Optimizer offers a wide set of free login, hardening and monitoring controls, with positive signs of support and maintenance.
- Developer and cost: SiteGround develops the plugin, which is free to use.
- Directory standing: It is among the directory’s most widely installed plugins, with excellent ratings across a moderate number of reviews.
- Support and upkeep: All four support threads are resolved, a positive responsiveness signal. The plugin was updated 15 days ago, pointing to ongoing maintenance.
- Who it suits: It is a practical fit for site owners seeking one free toolkit for login safeguards, file hardening and basic activity monitoring. Before enabling restrictions, check whether your site relies on XML-RPC connections or RSS and ATOM readers.
