{"id":365483,"date":"2026-09-14T22:38:49","date_gmt":"2026-09-14T22:38:49","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/simplesecurity\/"},"modified":"2026-09-20T16:03:22","modified_gmt":"2026-09-20T16:03:22","slug":"yuracode-security","status":"publish","type":"plugin","link":"https:\/\/kn.wordpress.org\/plugins\/yuracode-security\/","author":23562334,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"1.0.3","stable_tag":"1.0.3","tested":"7.1.1","requires":"6.0","requires_php":"8.0","requires_plugins":null,"header_name":"YuraCode Security","header_author":"YuraCode","header_description":"Lightweight hardening, brute-force login protection, and an Apache .htaccess firewall (8G ruleset) for WordPress.","assets_banners_color":"596e81","last_updated":"2026-09-20 16:03:22","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"https:\/\/security.yuraco.de\/wordpress\/","header_author_uri":"","rating":0,"author_block_rating":0,"active_installs":0,"downloads":188,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"1.0.0":{"tag":"1.0.0","author":"yuracode","date":"2026-09-14 22:41:31","revision":3696014},"1.0.1":{"tag":"1.0.1","author":"yuracode","date":"2026-09-15 22:12:42","revision":3697743},"1.0.2":{"tag":"1.0.2","author":"yuracode","date":"2026-09-19 17:23:03","revision":3703514},"1.0.3":{"tag":"1.0.3","author":"yuracode","date":"2026-09-20 16:03:22","revision":3704407}},"upgrade_notice":[],"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3696012,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3696012,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3703419,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3703419,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0.0","1.0.1","1.0.2","1.0.3"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3697743,"resolution":"1","location":"assets","locale":"","width":1280,"height":600},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3697743,"resolution":"2","location":"assets","locale":"","width":1280,"height":529},"screenshot-3.png":{"filename":"screenshot-3.png","revision":3697743,"resolution":"3","location":"assets","locale":"","width":1280,"height":701}},"screenshots":{"1":"The settings screen: every protection is already on with recommended settings.","2":"Login protection: attackers are locked out after too many failed attempts.","3":"The firewall: malicious traffic is blocked before it reaches your site."}},"plugin_section":[],"plugin_tags":[1174,602,1184,600,599],"plugin_category":[38,54],"plugin_contributors":[280747],"plugin_business_model":[],"class_list":["post-365483","plugin","type-plugin","status-publish","hentry","plugin_tags-firewall","plugin_tags-login","plugin_tags-malware","plugin_tags-security","plugin_tags-spam","plugin_category-authentication","plugin_category-security-and-spam-protection","plugin_contributors-yuracode","plugin_committers-yuracode"],"banners":{"banner":"https:\/\/ps.w.org\/yuracode-security\/assets\/banner-772x250.png?rev=3703419","banner_2x":"https:\/\/ps.w.org\/yuracode-security\/assets\/banner-1544x500.png?rev=3703419","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/yuracode-security\/assets\/icon-128x128.png?rev=3696012","icon_2x":"https:\/\/ps.w.org\/yuracode-security\/assets\/icon-256x256.png?rev=3696012","generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/yuracode-security\/assets\/screenshot-1.png?rev=3697743","caption":"The settings screen: every protection is already on with recommended settings."},{"src":"https:\/\/ps.w.org\/yuracode-security\/assets\/screenshot-2.png?rev=3697743","caption":"Login protection: attackers are locked out after too many failed attempts."},{"src":"https:\/\/ps.w.org\/yuracode-security\/assets\/screenshot-3.png?rev=3697743","caption":"The firewall: malicious traffic is blocked before it reaches your site."}],"raw_content":"<!--section=description-->\n<p>YuraCode Security helps keep your WordPress site safe from the moment you activate it. There's nothing to set up. Every protection is already on with safe, recommended settings. You can review or change anything on the Settings \u2192 YuraCode Security screen.<\/p>\n\n<p>We protect your site in three simple ways: <strong>Closing Security Loopholes<\/strong>, <strong>Stopping Password Guessers<\/strong>, and <strong>Filtering Bad Traffic<\/strong>.<\/p>\n\n<h4>1. Closing Security Loopholes<\/h4>\n\n<ul>\n<li><strong>Hides your WordPress version:<\/strong> Attackers scan for specific WordPress versions with known bugs. We hide yours so you're not an easy target.<\/li>\n<li><strong>Locks down the file editor:<\/strong> Intruders often use the built-in editor to plant malicious code. We turn it off so a compromised account can't ruin your site.<\/li>\n<li><strong>Doesn't reveal usernames:<\/strong> Shows the same generic error whether the username or the password is wrong, so attackers can't tell which accounts are real.<\/li>\n<li><strong>Turns off risky features:<\/strong> We switch off little-used features that attackers often abuse to get in, like XML-RPC and application passwords.<\/li>\n<li><strong>Blocks AI requests:<\/strong> Turns off WordPress's AI client so plugins and core can't send prompts out from your site.<\/li>\n<li><strong>Adds browser protection:<\/strong> Tells visitors' browsers to be stricter with your pages, which blocks a few common disguise tricks and stops other sites from pretending to be you.<\/li>\n<li><strong>Optional spam protection:<\/strong> Turn off comments entirely to stop comment spam bots (off by default).<\/li>\n<\/ul>\n\n<h4>2. Stopping Password Guessers<\/h4>\n\n<ul>\n<li><strong>Blocks \"Brute Force\" attacks:<\/strong> Attackers use automated bots to guess thousands of passwords a second. YuraCode watches your login form and instantly locks out anyone who guesses wrong too many times (default: 5 failed attempts locks them out for 15 minutes).<\/li>\n<\/ul>\n\n<h4>3. Filtering Bad Traffic (Firewall)<\/h4>\n\n<p>Think of this as a bouncer at the door of your website. It checks every visitor before your site even loads and kicks out the troublemakers.\n* <strong>Blocks malicious visitors:<\/strong> Recognizes known attack patterns and blocks them immediately.\n* <strong>Protects your private files:<\/strong> Ensures sensitive files (like your site's database settings or backups) can't be downloaded by strangers.\n* <strong>Stops malicious uploads:<\/strong> If an attacker manages to upload a file, this prevents the file from actually running any harmful code on your server.<\/p>\n\n<h3>Privacy<\/h3>\n\n<p>YuraCode Security makes no external requests and collects zero user data. It runs entirely on your server. The only files it writes are its own local settings and the firewall rules it manages (with an automatic backup of your original file kept in the uploads folder).<\/p>\n\n<h3>Credits<\/h3>\n\n<p>The built-in firewall ruleset is the excellent <a href=\"https:\/\/perishablepress.com\/8g-firewall\/\">8G Firewall<\/a> by Perishable Press.<\/p>\n\n<!--section=installation-->\n<ol>\n<li>Install and activate YuraCode Security from your site's <strong>Plugins<\/strong> screen.<\/li>\n<li>Done! Your site is instantly protected.<\/li>\n<li>(Optional) If you ever need to change a setting, you can review them on the <strong>Settings \u2192 YuraCode Security<\/strong> screen.<\/li>\n<\/ol>\n\n<!--section=faq-->\n<dl>\n<dt id=\"do%20i%20need%20to%20configure%20anything%3F\"><h3>Do I need to configure anything?<\/h3><\/dt>\n<dd><p>No. Every protection is already turned on with safe, recommended settings. You can review or adjust them at any time under <strong>Settings \u2192 YuraCode Security<\/strong>.<\/p><\/dd>\n<dt id=\"does%20yuracode%20security%20work%20on%20any%20hosting%3F\"><h3>Does YuraCode Security work on any hosting?<\/h3><\/dt>\n<dd><p>Yes! The core protections (closing loopholes and stopping password guessers) work on every hosting setup. The firewall feature requires an Apache or LiteSpeed server (which most shared hosting uses). If your site runs on nginx or IIS, the plugin detects that and skips the firewall, with a notice explaining why.<\/p><\/dd>\n<dt id=\"does%20yuracode%20security%20speed%20up%20my%20site%3F\"><h3>Does YuraCode Security speed up my site?<\/h3><\/dt>\n<dd><p>It is not a caching or optimization plugin, but it does trim a little: emojis and self-pinging add background code to every page, and we remove it. The effect is modest; the main benefit is security.<\/p><\/dd>\n<dt id=\"does%20yuracode%20security%20send%20my%20data%20anywhere%3F\"><h3>Does YuraCode Security send my data anywhere?<\/h3><\/dt>\n<dd><p>Never. The plugin runs 100% on your server, makes no external calls, and collects zero data. Your privacy is fully protected.<\/p><\/dd>\n<dt id=\"what%20happens%20to%20my%20site%20when%20i%20deactivate%20the%20plugin%3F\"><h3>What happens to my site when I deactivate the plugin?<\/h3><\/dt>\n<dd><p>Everything goes right back to normal. The firewall's rules are safely removed from your <code>.htaccess<\/code> file, and a backup of your original file is kept in your uploads folder just in case.<\/p><\/dd>\n<dt id=\"i%20am%20a%20developer.%20what%20exactly%20does%20it%20do%20technically%3F\"><h3>I am a developer. What exactly does it do technically?<\/h3><\/dt>\n<dd><ul>\n<li>Disables XML-RPC, theme and plugin file editors, application passwords, AI prompts, emojis, and self-pingbacks.<\/li>\n<li>Hides the WordPress core and asset version strings, and returns generic login error messages.<\/li>\n<li>Sends conservative response headers on the front end: <code>X-Content-Type-Options: nosniff<\/code>, <code>Referrer-Policy: strict-origin-when-cross-origin<\/code>, and <code>X-Frame-Options: SAMEORIGIN<\/code>. Each is only sent when nothing else has already set it.<\/li>\n<li>Login protection throttles an IP address after too many failed attempts.<\/li>\n<li>The firewall uses the 8G ruleset by Perishable Press, written to <code>.htaccess<\/code> and the uploads folder, to block malicious query strings, request URIs, user agents, and referrers. It also protects <code>wp-config.php<\/code> and blocks PHP execution in <code>\/uploads<\/code>.<\/li>\n<\/ul><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>1.0.3<\/h4>\n\n<ul>\n<li>New: A dismissible prompt on the settings screen to enable automatic plugin updates.<\/li>\n<\/ul>\n\n<h4>1.0.2<\/h4>\n\n<ul>\n<li>New: Sends safer browser response headers (file-type sniffing, referrer, and clickjacking protection).<\/li>\n<li>Fixed: The firewall's local-development detection now also works when the rules are generated from the command line or a scheduled task, so it no longer blocks the login page on a localhost site.<\/li>\n<\/ul>\n\n<h4>1.0.1<\/h4>\n\n<ul>\n<li>New: Turn off the built-in theme and plugin file editor.<\/li>\n<li>Fixed: the firewall no longer gets in the way on local development sites (localhost\/loopback).<\/li>\n<\/ul>\n\n<h4>1.0.0<\/h4>\n\n<ul>\n<li>Initial release.<\/li>\n<\/ul>","raw_excerpt":"Protects your WordPress site automatically. No setup needed. Stops password guessing and blocks malicious traffic before they reach you.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/kn.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/365483","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/kn.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/kn.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/kn.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=365483"}],"author":[{"embeddable":true,"href":"https:\/\/kn.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/yuracode"}],"wp:attachment":[{"href":"https:\/\/kn.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=365483"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/kn.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=365483"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/kn.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=365483"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/kn.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=365483"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/kn.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=365483"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/kn.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=365483"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}