I’ve had this plugin installed for a few years and have really appreciated some of it’s features, but now I see that this plugin has been discontinued. Do you have any recommendations on a replacement plugin that has similar functionality?

At this point I’m likely to look under the hood and copy some of the code into a fully private plugin, but I would prefer an alternative plugin. I liked how this plugin was not too bloated and it’s upsell marketing was relatively tame.

Hi,

This plugin causes lots of PHP warnings when using the WP-CLI:

PHP Warning: Constant DB_NAME already defined in [...]/public/wp-config.php on line 25
Warning: Constant DB_NAME already defined in [...]/public/wp-config.php on line 25
PHP Warning: Constant DB_USER already defined in [...]/public/wp-config.php on line 28
Warning: Constant DB_USER already defined in [...]/public/wp-config.php on line 28
PHP Warning: Constant DB_PASSWORD already defined in [...]/public/wp-config.php on line 31
Warning: Constant DB_PASSWORD already defined in [...]/public/wp-config.php on line 31
PHP Warning: Constant DB_HOST already defined in [...]/public/wp-config.php on line 34
Warning: Constant DB_HOST already defined in [...]/public/wp-config.php on line 34
PHP Warning: Constant DB_CHARSET already defined in [...]/public/wp-config.php on line 37
Warning: Constant DB_CHARSET already defined in [...]/public/wp-config.php on line 37
PHP Warning: Constant DB_COLLATE already defined in [...]/public/wp-config.php on line 40
Warning: Constant DB_COLLATE already defined in [...]/public/wp-config.php on line 40
PHP Warning: Constant AUTH_KEY already defined in [...]/public/wp-config.php on line 51
Warning: Constant AUTH_KEY already defined in [...]/public/wp-config.php on line 51
PHP Warning: Constant SECURE_AUTH_KEY already defined in [...]/public/wp-config.php on line 52
Warning: Constant SECURE_AUTH_KEY already defined in [...]/public/wp-config.php on line 52
PHP Warning: Constant LOGGED_IN_KEY already defined in [...]/public/wp-config.php on line 53
Warning: Constant LOGGED_IN_KEY already defined in [...]/public/wp-config.php on line 53
PHP Warning: Constant NONCE_KEY already defined in [...]/public/wp-config.php on line 54
Warning: Constant NONCE_KEY already defined in [...]/public/wp-config.php on line 54
PHP Warning: Constant AUTH_SALT already defined in [...]/public/wp-config.php on line 55
Warning: Constant AUTH_SALT already defined in [...]/public/wp-config.php on line 55
PHP Warning: Constant SECURE_AUTH_SALT already defined in [...]/public/wp-config.php on line 56
Warning: Constant SECURE_AUTH_SALT already defined in [...]/public/wp-config.php on line 56
PHP Warning: Constant LOGGED_IN_SALT already defined in [...]/public/wp-config.php on line 57
Warning: Constant LOGGED_IN_SALT already defined in [...]/public/wp-config.php on line 57
PHP Warning: Constant NONCE_SALT already defined in [...]/public/wp-config.php on line 58
Warning: Constant NONCE_SALT already defined in [...]/public/wp-config.php on line 58
PHP Warning: Constant WP_CACHE_KEY_SALT already defined in [...]/public/wp-config.php on line 59
Warning: Constant WP_CACHE_KEY_SALT already defined in [...]/public/wp-config.php on line 59

It looks like the cause of this has already been raised in a previous ticket but I’m not able to join that conversation:

I believe I have partially figured out what is going on, the /modules/hooks.php file has this code at the top:

require_once(ABSPATH."/wp-includes/pluggable.php");
require_once(ABSPATH."/wp-load.php");

https://www.ads-software.com/support/topic/php-warnings-after-upgrading-to-php-8-2/

This makes using the WP-CLI very noisy and much harder to use so it should definitely be fixed.

Thanks

I just upgraded our servers from PHP 7.4 to PHP 8.2 and our frontend and admin screens are working okay, no noisy warnings, but when I use the wp-cli provided by my host (Cloudways) I’m getting lots of warnings. Here is a portion of the warnings I’m getting when I run ANY wp-cli command. You’ll notice that basically every constant that is defined my wp-config.php gets two lines of warnings.

myuser@333333 ~/public_html $ wp eval --skip-themes "var_dump(WP_DEBUG);"
PHP Warning: Constant WP_CACHE already defined in /home/333333.cloudwaysapps.com/myuser/public_html/wp-config.php on line 3
Warning: Constant WP_CACHE already defined in /home/333333.cloudwaysapps.com/myuser/public_html/wp-config.php on line 3
PHP Warning: Constant WP_CACHE_KEY_SALT already defined in /home/333333.cloudwaysapps.com/myuser/public_html/wp-config.php on line 4
Warning: Constant WP_CACHE_KEY_SALT already defined in /home/333333.cloudwaysapps.com/myuser/public_html/wp-config.php on line 4
PHP Warning: Constant DB_NAME already defined in /home/333333.cloudwaysapps.com/myuser/public_html/wp-config.php on line 42
Warning: Constant DB_NAME already defined in /home/333333.cloudwaysapps.com/myuser/public_html/wp-config.php on line 42
PHP Warning: Constant DB_USER already defined in /home/333333.cloudwaysapps.com/myuser/public_html/wp-config.php on line 46
Warning: Constant DB_USER already defined in /home/333333.cloudwaysapps.com/myuser/public_html/wp-config.php on line 46
PHP Warning: Constant DB_PASSWORD already defined in /home/333333.cloudwaysapps.com/myuser/public_html/wp-config.php on line 50
Warning: Constant DB_PASSWORD already defined in /home/333333.cloudwaysapps.com/myuser/public_html/wp-config.php on line 50
PHP Warning: Constant DB_HOST already defined in /home/333333.cloudwaysapps.com/myuser/public_html/wp-config.php on line 54
Warning: Constant DB_HOST already defined in /home/333333.cloudwaysapps.com/myuser/public_html/wp-config.php on line 54
PHP Warning: Constant DB_CHARSET already defined in /home/333333.cloudwaysapps.com/myuser/public_html/wp-config.php on line 58
Warning: Constant DB_CHARSET already defined in /home/333333.cloudwaysapps.com/myuser/public_html/wp-config.php on line 58
PHP Warning: Constant DB_COLLATE already defined in /home/333333.cloudwaysapps.com/myuser/public_html/wp-config.php on line 62
Warning: Constant DB_COLLATE already defined in /home/333333.cloudwaysapps.com/myuser/public_html/wp-config.php on line 62
PHP Warning: Constant AUTH_KEY already defined in /home/333333.cloudwaysapps.com/myuser/public_html/wp-salt.php on line 10
Warning: Constant AUTH_KEY already defined in /home/333333.cloudwaysapps.com/myuser/public_html/wp-salt.php on line 10
PHP Warning: Constant SECURE_AUTH_KEY already defined in /home/333333.cloudwaysapps.com/myuser/public_html/wp-salt.php on line 11
Warning: Constant SECURE_AUTH_KEY already defined in /home/333333.cloudwaysapps.com/myuser/public_html/wp-salt.php on line 11
PHP Warning: Constant LOGGED_IN_KEY already defined in /home/333333.cloudwaysapps.com/myuser/public_html/wp-salt.php on line 12
Warning: Constant LOGGED_IN_KEY already defined in /home/333333.cloudwaysapps.com/myuser/public_html/wp-salt.php on line 12
PHP Warning: Constant NONCE_KEY already defined in /home/333333.cloudwaysapps.com/myuser/public_html/wp-salt.php on line 13
Warning: Constant NONCE_KEY already defined in /home/333333.cloudwaysapps.com/myuser/public_html/wp-salt.php on line 13
PHP Warning: Constant AUTH_SALT already defined in /home/333333.cloudwaysapps.com/myuser/public_html/wp-salt.php on line 14
Warning: Constant AUTH_SALT already defined in /home/333333.cloudwaysapps.com/myuser/public_html/wp-salt.php on line 14
PHP Warning: Constant SECURE_AUTH_SALT already defined in /home/333333.cloudwaysapps.com/myuser/public_html/wp-salt.php on line 15
Warning: Constant SECURE_AUTH_SALT already defined in /home/333333.cloudwaysapps.com/myuser/public_html/wp-salt.php on line 15
PHP Warning: Constant LOGGED_IN_SALT already defined in /home/333333.cloudwaysapps.com/myuser/public_html/wp-salt.php on line 16
Warning: Constant LOGGED_IN_SALT already defined in /home/333333.cloudwaysapps.com/myuser/public_html/wp-salt.php on line 16
PHP Warning: Constant NONCE_SALT already defined in /home/333333.cloudwaysapps.com/myuser/public_html/wp-salt.php on line 17
Warning: Constant NONCE_SALT already defined in /home/333333.cloudwaysapps.com/myuser/public_html/wp-salt.php on line 17
PHP Warning: Constant FS_METHOD already defined in /home/333333.cloudwaysapps.com/myuser/public_html/wp-config.php on line 118
Warning: Constant FS_METHOD already defined in /home/333333.cloudwaysapps.com/myuser/public_html/wp-config.php on line 118
PHP Warning: Constant WPLANG already defined in /home/333333.cloudwaysapps.com/myuser/public_html/wp-config.php on line 120
Warning: Constant WPLANG already defined in /home/333333.cloudwaysapps.com/myuser/public_html/wp-config.php on line 120
PHP Warning: Constant FS_CHMOD_DIR already defined in /home/333333.cloudwaysapps.com/myuser/public_html/wp-config.php on line 122
Warning: Constant FS_CHMOD_DIR already defined in /home/333333.cloudwaysapps.com/myuser/public_html/wp-config.php on line 122
PHP Warning: Constant FS_CHMOD_FILE already defined in /home/333333.cloudwaysapps.com/myuser/public_html/wp-config.php on line 124
Warning: Constant FS_CHMOD_FILE already defined in /home/333333.cloudwaysapps.com/myuser/public_html/wp-config.php on line 124
PHP Warning: Constant DISABLE_WP_CRON already defined in /home/333333.cloudwaysapps.com/myuser/public_html/wp-config.php on line 143
Warning: Constant DISABLE_WP_CRON already defined in /home/333333.cloudwaysapps.com/myuser/public_html/wp-config.php on line 143

For clarity, these warnings are not emitted when I have the server configured to use PHP 7.4, it only started when I upgraded the server to PHP 8.2.

I’ve definitively narrowed the noisy offending plugin down to wp-security-hardening by using the wp-cli’s “–skip-plugins” option, so I get these warnings every time until I run it with –skip-plugins=wp-security-hardening.

In terms of environment that I’m running, my host is Cloudways and the WP-CLI executable is provided by the hosting provider and the version of it is WP-CLI 2.9.0.

WP Hardening reports /dev/null permissions set to 666 by default as wrong! This is not only incorrect but also dangerous! If anyone followed this recommendation and changed the permissions to /dev/null, it could result in crashes not only of numerous applications, but also of the entire system! Could you please fix this?

Hello,

there is some conflict with the WordPress 6.2. ‘Add new post’ results in blank screen. Disabling the setting “Remove Version from Script” helps with this issue.

• This topic was modified 1 year, 7 months ago by kubastas.

hello, me use astra web security firewall and when i install astra wp hardening. i got this notice

File Permission Checker

Poor file & folder permissions detected.

666 > /home/domain.comd/public_html/wp-content/plugins/getastra/astra/astra-config.php

are its okay ? or i need to change permissions?

Hello,

Why is plugin loading files and font awesome on all pages???

Please condition loading your assets only in your exact admin pages, I am forced to disable the plugin now because of this …

Thank you

Hello,

I just found out that disabling REST API is unabling people to change the password on my website.

When they submit change of password, they get the email with reset link, but after opening the link they get this message:

{“code”:”rest_not_logged_in”,”message”:”You are not currently logged in.”,”data”:{“status”:401}}

What makes sense, because I suppose from what I have found that it is disabling Rest API only for logged out users, but this could be exception, because noone can change forgotten password this way

i just installed this plugin and cannot connect Wordfence to Wordfence Central anymore:

“Unable to communicate with Wordfence plugin. Please verify Wordfence is installed and activated on this site.”

any idea why?

Hi everyone !

Thanks to the devs, WP Hardening works like a charm on my website ??

However, when I do a site audit on Ahrefs, I get a warning for the CSS file size being too large.

It’s about the tw-bs4.css which is the bootstrap if I understand well.

The CSS is only 24 kb but I don’t like warnings and avoid them if I can.

Is there anything I could do to reduce the CSS file size ?

Thanks and have a great day !

Fred

Hi WP Hardening team,

I found a bug that cause error on edit page/post with WP ver 6.1 and WP Hardening ver 1.2.6

other page work fine, just the edit/add new page/post

TypeError: (0 , E.__experimentaluseLayoutClasses) is not a function
    at Xt (https://toryburch.local.com/wp-includes/js/dist/edit-post.min.js:7:40200)
    at ct (https://toryburch.local.com/wp-includes/js/dist/vendor/react-dom.min.js:9:43430)
    at os (https://toryburch.local.com/wp-includes/js/dist/vendor/react-dom.min.js:9:111136)
    at Ur (https://toryburch.local.com/wp-includes/js/dist/vendor/react-dom.min.js:9:77643)
    at Ir (https://toryburch.local.com/wp-includes/js/dist/vendor/react-dom.min.js:9:77571)
    at Dr (https://toryburch.local.com/wp-includes/js/dist/vendor/react-dom.min.js:9:77434)
    at Pr (https://toryburch.local.com/wp-includes/js/dist/vendor/react-dom.min.js:9:74429)
    at https://toryburch.local.com/wp-includes/js/dist/vendor/react-dom.min.js:9:30173
    at unstable_runWithPriority (https://toryburch.local.com/wp-includes/js/dist/vendor/react.min.js:9:7431)
    at xn (https://toryburch.local.com/wp-includes/js/dist/vendor/react-dom.min.js:9:29950)

hi , my problelm is when i enable “Remove Version from Script” this setting in wp hardening plugin than web story dashboard Plugin is not Open, dashboard is only Loading, and when I disable this setting than webs story plugin dashboard is load smoothly.

i know this is very imp. setting in hardening plugin but when i enable this setting , this create problem with web story plugin dashboard

• This topic was modified 2 years ago by Mk.

Hello, after activating all the options in the WP Hardening plugin, Wappalyzer is still getting all the information related WP version and other details. Any solution?

I think it would be a great additional security feature if you could include an option to use either an author’s name or nickname or other configurable name in the author’s slug, anything other than the username that can be used for admin login. Maybe a simplified version of the ‘Edit Author Slug’ plugin?

Shouldn’t this option actually hide the login url? I’ve changed the admin login url and the new url works ok, but so does the default one, /wp-admin now redirects to /new-admin-name! Shouldn’t wp-admin go to a 404 not found page?

Hi,

When enabled WP Hardening I’m experiencing a broken backend page of forminator plugin. please have a look at this screenshot https://tinyurl.com/2dhe4rd6 for your reference.

steps to reproduce:
WordPress version : 6.0.1
Forminator version: 1.17.2
WP Hardening version: 1.2.5

I hope I have the most recent version

I tried to switch off all the plugins and turned them on one by one and noticed that enabling WP Hardening broke the forminator page.

I’m turning the hardening plugin off until this issue is fixed.

let me know your feedback.

Hi,
I have installed wp hardening plugin in one of my websites.
Under the recommendation section the plugin shows

Your current PHP version (8.0) is outdated and can invite hackers.
Steps to Fix:
Move to the latest and secured version (7.4) with this guide here.

It’s asking to revert it back to older php version.
Can someone please provide a solution for this?

• This topic was modified 2 years, 4 months ago by Cyriac Athickal.

Plugin is displaying “!Improve Hardening” header on my site. For all users, also not logged in.

How can I disable this header and leave it only for admins?

I see there is a plugin update added a few hours ago. I installed it, but didn’t help.

Able to install this plugin in lower environments and worked fine. but when we deployed it on production server and started activating it, started throwing error of 504 gateway exceptions and entire WordPress dashboard become unresponsive.
Is there any default firewall rules will this plugins comes with? or what kind of measures we have to take before deploying this plugin to production servers.

Hi,
My logs is keeping showing each 15 seconds:

[11-Mar-2022 19:28:20 UTC] PHP Warning:  Cannot modify header information - headers already sent in /bitnami/wordpress/wp-content/plugins/wp-security-hardening/wp-hardening.php on line 91
[11-Mar-2022 19:28:20 UTC] PHP Warning:  Cannot modify header information - headers already sent in /bitnami/wordpress/wp-content/plugins/wp-security-hardening/wp-hardening.php on line 95

Best regards

I just upgraded to WP 5.9 and while the front end of my website works fine I cannot create new pages or posts. I deactivated each plugin one by one and discovered it is WP Hardening causing the conflict.

This is the error message

TypeError: Cannot read properties of undefined (reading 'ref')
    at https://xxx.in/wp-includes/js/dist/edit-post.min.js:7:10367
    at we (https://xxx.in/wp-includes/js/dist/vendor/react-dom.min.js:84:293)
    at nh (https://xxx.in/wp-includes/js/dist/vendor/react-dom.min.js:96:43)
    at zj (https://xxx.in/wp-includes/js/dist/vendor/react-dom.min.js:230:425)
    at Th (https://xxx.in/wp-includes/js/dist/vendor/react-dom.min.js:152:223)
    at tj (https://xxx.in/wp-includes/js/dist/vendor/react-dom.min.js:152:152)
    at Te (https://xxx.in/wp-includes/js/dist/vendor/react-dom.min.js:146:151)
    at https://xxx.in/wp-includes/js/dist/vendor/react-dom.min.js:61:68
    at unstable_runWithPriority (https://xxx.in/wp-includes/js/dist/vendor/react.min.js:25:260)
    at Da (https://xxx.in/wp-includes/js/dist/vendor/react-dom.min.js:60:280)

Other then deactivating the plugin is there a fix at all?

Hello Team,
We want to restrict the media file content to be accessed only by the admin. no other user or viewer of the website should access the media files. Can it be done with the help of this plugin?
Expecting Help.
Thank You

Hi,

Updated to the latest version of wordpress 5.9.

Changed theme to customizr. When editing the preview of images gives me the error “This block encountered an error and cannot be previewed”.

The problem lies in WP Hardening “Remove version from script”. When I toggle it off, the preview works.

Why is that? I cant seem to understand what happenes.

Hello,

why are you putting css and js to the frontend pages? Page then needs to load more requests, the pagespeedscore is lowered and I think it has no point of having it loaded.

Hi,

First of all, thank you for such a useful plugin.

Unfortunately I can’t make it work with the JWT Authentication for WP-API (https://br.www.ads-software.com/plugins/jwt-authentication-for-wp-rest-api/) plugin.

I have a service that accesses the endpoint wp-json/jwt-auth/v1/token without being authenticated to authenticate itself, and then does some requests to other APIs.

Is it the defaut behavier, right? Is it possible to add some routes on a whitelist to being accessed w/o need the authentication?

Hello Astra Security,
We recently upgrade WP Hardening plugin to version 1.2.2. Our users were not able to log in afterwards. Can you please tell us what changes were made between versions 1.2.1 and 1.2.2?

Hi,

I have just installed th eplugin and it is still possible to enumerate users usign the following URL :

https://xxxxxx.org/wp-json/wp/v2/users

“Stop user enumeration” is enabled.

Thanks.

Patrick

• This topic was modified 3 years, 1 month ago by samoreen.

Hi,

I have installed WP hardening because I have seen through Wordfence plugin that I had a lot of attacks to the wp-admin login page. Fortunately I activated the 2FA method.
After having installed WP Hardening and changed the /wp-admin by /login path the wp-admin continues to be operative. It just redirects to /login.

The plugin is not working correctly? or it is not compatible with Wordfence?

kind regards,
David

Hi, I’m just comparing your plugin to other options and compared your Change Login URL facitlity to the WPS Hide Login pluigin. Am I correct in thinking that your plugin DOES NOT hide/prevent acccess to the wp-admin pages, but rather only changes the url of wp-login.php? If so can I ask why not? To my knowledge, blocking traffic to both wp-admin and wp-login pages is usually considered best security practice. Any help appreciated.

When trying to install this plugin, I’ve encountered the following error:

Warning: require_once(/www/wp-content/plugins/../../wp-load.php): failed to open stream: No such file or directory in /www/wp-content/plugins/wp-security-hardening/modules/hooks.php on line 3 Fatal error: require_once(): Failed opening required ‘/www/wp-content/plugins/../../wp-load.php’ (include_path=’.:/usr/share/php’) in /www/wp-content/plugins/wp-security-hardening/modules/hooks.php on line 3

With the research I’ve done I’m inclined to believe that this error is happening because of the a lack of an htaccess file. Since our site is hosted on NGINX servers and NGINX servers cannot have an htaccess file, does that mean that this plugin won’t work with my site?