Qodile Security

Clean and harden WordPress: <head>, headers, REST API and file integrity.

Qodile Security bundles a set of independent hardening features behind a single settings screen. Each one is a simple on/off toggle, so you only run what you need. Built and proven on real sites.

Features

• Clean the <head> (generator, RSD, WLW, feeds, shortlink, asset versions) and disable XML-RPC.
• Lock the REST API to authenticated users, with a configurable whitelist of public route prefixes.
• Hardened HTTP headers (X-Frame-Options, Referrer-Policy, Permissions-Policy…) and masked X-Powered-By.
• Generic login error messages (anti account-enumeration).
• Daily file integrity monitoring (SHA-256 over core, plugins, mu-plugins and the active theme) with e-mail, log and admin-notice alerts. Works on classic installs and Bedrock.

Privacy

The plugin collects and transmits no visitor data. File integrity monitoring stores a baseline manifest and a log in wp-content/uploads/qodile-security/ (protected from direct web access); on any change, an e-mail is sent to the site admin. Nothing is sent to any third party.

Free software under GPLv2 or later — you can study, modify and redistribute it.