Renamed to Flex Website Security.<\/p>","1.2.2":"
Plugin URI removed for now. Author URI remains https:\/\/flexible.am\/.<\/p>","1.2.1":"
Readme and review fixes. Access \u2192 Clear lockouts now works. Permanent IP blocks are still kept.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3677349,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3677349,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.jpg":{"filename":"banner-1544x500.jpg","revision":3677424,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3677424,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.jpg":{"filename":"banner-772x250.jpg","revision":3677438,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3677424,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.2.3"],"block_files":[],"assets_screenshots":[],"screenshots":[]},"plugin_section":[],"plugin_tags":[602,595,600,214603,6558],"plugin_category":[38,54],"plugin_contributors":[240619,232306],"plugin_business_model":[],"class_list":["post-362320","plugin","type-plugin","status-publish","hentry","plugin_tags-login","plugin_tags-recaptcha","plugin_tags-security","plugin_tags-turnstile","plugin_tags-xml-rpc","plugin_category-authentication","plugin_category-security-and-spam-protection","plugin_contributors-flexfields","plugin_contributors-hovoqoch","plugin_committers-flexfields"],"banners":{"banner":"https:\/\/ps.w.org\/flex-website-security\/assets\/banner-772x250.png?rev=3677424","banner_2x":"https:\/\/ps.w.org\/flex-website-security\/assets\/banner-1544x500.png?rev=3677424","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/flex-website-security\/assets\/icon-128x128.png?rev=3677349","icon_2x":"https:\/\/ps.w.org\/flex-website-security\/assets\/icon-256x256.png?rev=3677349","generated":false},"screenshots":[],"raw_content":"\n
Flex Website Security<\/strong> is a lightweight hardening toolkit \u2014 not a full WAF or malware scanner. It reduces common attack surfaces: brute-force logins, XML-RPC abuse, user enumeration, and loose admin defaults.<\/p>\n\n Admin CSS and JavaScript ship with the plugin. Remote scripts and API calls run only when you enable captcha or the optional country lookup.<\/p>\n\n IP lockouts and permanent blocks are stored in your WordPress database. Only administrators can view or change them on Flex Website Security \u2192 Access<\/strong>.<\/p>\n\n Captcha<\/strong> (off by default): if you choose Cloudflare Turnstile or Google reCAPTCHA and save both keys, the login form loads that provider\u2019s script and sends the visitor IP plus the captcha token to the provider for verification.<\/p>\n\n Country lookup<\/strong> (off by default): country rules first use CDN headers (Cloudflare, CloudFront, and similar). If you enable the optional geojs.io lookup, public visitor IPs without a header are sent to geojs.io and cached for 7 days.<\/p>\n\n See Third-party services<\/strong> below for URLs, terms, and privacy policies.<\/p>\n\n These services are optional and off by default. No third-party script is loaded unless you choose a captcha provider and save both keys, or you enable the geojs.io lookup.<\/p>\n\n When enabled, the login form loads When enabled, the login form loads When enabled on Access, visitor IPs without a CDN country header are looked up at Flex Website Security is free software: you can redistribute it and\/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 2 of the License, or (at your option) any later version.<\/p>\n\n For more details, see https:\/\/www.gnu.org\/licenses\/gpl-2.0.html.<\/p>\n\n\n No. Flex Website Security turns on common hardening options. Pair it with Flex SSL for HTTPS and HSTS, and keep WordPress, themes, and plugins updated.<\/p><\/dd>\n Add Add Whole website mode still allows the login form so you can sign in and change the rule. Admin-only mode restricts login and wp-admin for guests.<\/p><\/dd>\n No. It removes temporary failed-login lockouts only. Permanent blocks stay until you Unblock them on Access.<\/p><\/dd>\n No. Failed captcha checks do not increment the attempt counter.<\/p><\/dd>\n Disabling XML-RPC or Application Passwords can affect older apps and some Jetpack features. Turn those options off if you still need them.<\/p><\/dd>\n Deleting the plugin removes settings, IP lockouts\/blocks, and country lookup cache. It does not remove \n
Privacy<\/h4>\n\n
Third-party services<\/h3>\n\n
Cloudflare Turnstile<\/h4>\n\n
https:\/\/challenges.cloudflare.com\/turnstile\/v0\/api.js<\/code> and verifies tokens at https:\/\/challenges.cloudflare.com\/turnstile\/v0\/siteverify<\/code>. Cloudflare receives the visitor IP and token.<\/p>\n\n\n
Google reCAPTCHA<\/h4>\n\n
https:\/\/www.google.com\/recaptcha\/api.js<\/code> and verifies tokens at https:\/\/www.google.com\/recaptcha\/api\/siteverify<\/code>. Google receives the visitor IP and token.<\/p>\n\n\n
geojs.io<\/h4>\n\n
https:\/\/get.geojs.io\/v1\/ip\/country\/{ip}<\/code> and cached for 7 days.<\/p>\n\n\n
License<\/h3>\n\n
\n
flex-website-security<\/code> folder to \/wp-content\/plugins\/<\/code>, or install the zip via Plugins \u2192 Add New \u2192 Upload Plugin<\/strong>.<\/li>\n\n
Is this a firewall or malware scanner?<\/h3><\/dt>\n
What if I lock myself out of a custom login URL?<\/h3><\/dt>\n
define( 'FLEX_SECURITY_DISABLE_CUSTOM_LOGIN', true );<\/code> to wp-config.php, or rename the plugin folder over SFTP. Bookmark the new login URL before you log out.<\/p><\/dd>\nWhat if a country rule blocks the site or login?<\/h3><\/dt>\n
define( 'FLEX_SECURITY_DISABLE_COUNTRY_BLOCK', true );<\/code> to wp-config.php, then fix Mode, Apply to, or the country list on Access<\/strong>.<\/p>\n\nDoes Clear lockouts remove permanent IP blocks?<\/h3><\/dt>\n
Do captcha failures count toward lockout?<\/h3><\/dt>\n
Will this break Jetpack or a mobile app?<\/h3><\/dt>\n
What happens when I uninstall?<\/h3><\/dt>\n
DISALLOW_FILE_EDIT<\/code> if you defined that constant yourself in wp-config.php.<\/p><\/dd>\n\n<\/dl>\n\n\n1.2.3<\/h4>\n\n
\n
1.2.2<\/h4>\n\n
\n
1.2.1<\/h4>\n\n
\n
1.2.0<\/h4>\n\n
\n
1.1.0<\/h4>\n\n
\n
1.0.0<\/h4>\n\n
\n