Àpèjúwe

A WordPress plugin that adds security headers, CSP, login protection, SMTP, spam protection and more. Functionality is continuously being expanded to cover more ground.

Features

Adds security headers, including configurable HSTS, X-Frame-Options, COOP and CORP
Supports Content Security Policy (CSP), editable from the admin UI and validated against unrecognized directives
Protects login with rate-limiting
Blocks weak passwords, with an exemption list for individual users
Blocks common/guessable usernames
Validates protected brand names against required domains. Self-registration blocks a brand-impersonating email outright
Locks file editing, with a temporary admin-bar toggle that automatically relocks after a period of inactivity
Honeypot spam protection (CF7, Elementor, WPForms, Forminator, lost password)
Custom SMTP sending, with a test-email button
Central security log with automatic retention, including new user account creation
Removes certain default WordPress traces from <head>
English, with community translations available via translate.wordpress.org

What does it protect against?

Basic login attacks
Some forms of user enumeration
Unwanted WordPress metadata
Missing security headers

Important: it does not protect against vulnerabilities in other plugins or themes, poor server configuration, or missing updates.

Compatibility

Some security headers can affect elements such as iframes, embeds and third-party scripts. Some of the CSP directives may be too strict and might need loosening depending on your needs. This is done from the CSP field in the admin UI, which is available to the administrator role.

About

Webro Security is developed and maintained by Webro, a web agency with offices in Odense and Aabenraa, Denmark. Webro builds and runs WordPress sites for companies across a wide range of industries, and this plugin grew out of that daily work. The same hardening steps were being repeated by hand on site after site, so they were collected into one plugin with settings that can be adjusted per site instead of edited in code.

The plugin is built by Lasse Enggaard and Rikke Rasmussen. Lasse Enggaard is a Danish SEO specialist and partner at Webro. He has worked with SEO since 2015 and with WordPress development alongside it, and today works with search visibility, AI visibility and technical WordPress work for companies.

Rikke Rasmussen is a web developer at Webro and has been closely involved in building the plugin and the testing across sites. Both of them continue to maintain it.

The plugin is aimed at site owners and the people who look after their sites, not at security researchers. Every setting has a plain-language explanation next to it, so it is clear what a given header or policy actually changes before it is turned on. Development continues, and features are added as they prove useful in real projects.