WordPress.org
Get WordPress

Plugin Directory

Changeset 3374742


Ignore:
Timestamp:
10/08/2025 02:09:25 AM (5 months ago)
Author:
chrmrtns
Message:

Update readme.txt with security hardening features documentation

  • Add comprehensive Security Hardening section
  • Highlight XML-RPC Disable, Application Passwords Control, and User Enumeration Prevention
  • Update heading from 'Why Choose Passwordless Login?' to 'Why Choose Keyless Auth?'
  • Add security features to Advanced Security list
  • Improve plugin visibility and branding
Location:
keyless-auth
Files:
2 edited

Legend:

Unmodified
Added
Removed

  • keyless-auth/tags/2.7.0/readme.txt

    r3374737 r3374742  
    1818Transform your WordPress login experience with passwordless authentication. Users simply enter their email address and receive a secure magic link – click to login instantly. It's more secure than weak passwords and infinitely more user-friendly.
    1919
    20 = Why Choose Passwordless Login? =
     20= Why Choose Keyless Auth? =
    2121
    2222* **Enhanced Security**: No more weak, reused, or compromised passwords
    … …  
    2424* **Reduced Support**: Eliminate "forgot password" requests
    2525* **Modern Authentication**: Enterprise-grade security used by Slack, Medium, and others
     26* **Security Hardening**: Built-in protection against brute force attacks and username enumeration
    2627
    2728= Quick Start =
    … …  
    4950* **Emergency Mode**: Grace period system with admin controls
    5051* **Secure Storage**: SMTP credentials in wp-config.php option
     52* **XML-RPC Disable**: Block brute force attacks via XML-RPC interface
     53* **Application Passwords Control**: Disable programmatic authentication when not needed
     54* **User Enumeration Prevention**: Block username discovery attacks
    5155
    5256**Customization**
    … …  
    109113* Device tracking and IP monitoring
    110114* Automatic maintenance and cleanup routines
     115
     116= Security Hardening =
     117
     118Keyless Auth includes comprehensive security hardening features to protect your WordPress site from common attack vectors. All features are optional and can be enabled based on your site's needs.
     119
     120**XML-RPC Disable**
     121* Prevents brute force attacks via WordPress XML-RPC interface
     122* Reduces attack surface by disabling legacy API
     123* Recommended for sites not using Jetpack, mobile apps, or pingbacks
     124
     125**Application Passwords Control**
     126* Disable REST API and XML-RPC authentication when programmatic access isn't needed
     127* Prevents unauthorized API access
     128* Recommended for simple sites without third-party integrations
     129
     130**User Enumeration Prevention**
     131* Blocks REST API user endpoints (`/wp-json/wp/v2/users`)
     132* Redirects author archives and `?author=N` queries
     133* Removes login error messages that reveal usernames
     134* Strips comment author CSS classes
     135* Removes author data from oEmbed responses
     136* Recommended for business/corporate sites without author profiles
     137
     138**Benefits**
     139* Combined protection against brute force attacks
     140* Prevents username discovery for targeted attacks
     141* Reduces unauthorized API access
     142* Easy to configure without code or .htaccess modifications
     143* All features include comprehensive documentation
     144* FTP recovery available if needed
    111145
    112146= SMTP & Email Delivery =

  • keyless-auth/trunk/readme.txt

    r3374737 r3374742  
    1818Transform your WordPress login experience with passwordless authentication. Users simply enter their email address and receive a secure magic link – click to login instantly. It's more secure than weak passwords and infinitely more user-friendly.
    1919
    20 = Why Choose Passwordless Login? =
     20= Why Choose Keyless Auth? =
    2121
    2222* **Enhanced Security**: No more weak, reused, or compromised passwords
    … …  
    2424* **Reduced Support**: Eliminate "forgot password" requests
    2525* **Modern Authentication**: Enterprise-grade security used by Slack, Medium, and others
     26* **Security Hardening**: Built-in protection against brute force attacks and username enumeration
    2627
    2728= Quick Start =
    … …  
    4950* **Emergency Mode**: Grace period system with admin controls
    5051* **Secure Storage**: SMTP credentials in wp-config.php option
     52* **XML-RPC Disable**: Block brute force attacks via XML-RPC interface
     53* **Application Passwords Control**: Disable programmatic authentication when not needed
     54* **User Enumeration Prevention**: Block username discovery attacks
    5155
    5256**Customization**
    … …  
    109113* Device tracking and IP monitoring
    110114* Automatic maintenance and cleanup routines
     115
     116= Security Hardening =
     117
     118Keyless Auth includes comprehensive security hardening features to protect your WordPress site from common attack vectors. All features are optional and can be enabled based on your site's needs.
     119
     120**XML-RPC Disable**
     121* Prevents brute force attacks via WordPress XML-RPC interface
     122* Reduces attack surface by disabling legacy API
     123* Recommended for sites not using Jetpack, mobile apps, or pingbacks
     124
     125**Application Passwords Control**
     126* Disable REST API and XML-RPC authentication when programmatic access isn't needed
     127* Prevents unauthorized API access
     128* Recommended for simple sites without third-party integrations
     129
     130**User Enumeration Prevention**
     131* Blocks REST API user endpoints (`/wp-json/wp/v2/users`)
     132* Redirects author archives and `?author=N` queries
     133* Removes login error messages that reveal usernames
     134* Strips comment author CSS classes
     135* Removes author data from oEmbed responses
     136* Recommended for business/corporate sites without author profiles
     137
     138**Benefits**
     139* Combined protection against brute force attacks
     140* Prevents username discovery for targeted attacks
     141* Reduces unauthorized API access
     142* Easy to configure without code or .htaccess modifications
     143* All features include comprehensive documentation
     144* FTP recovery available if needed
    111145
    112146= SMTP & Email Delivery =
Note: See TracChangeset for help on using the changeset viewer.