KeepSoul 2.0 Reputation Shield

Tested exclusively with the Flatsome theme. Activates strict REST API and XML-RPC restrictions. Warning: when Admin Panel Security is active, your entire admin environment is strictly isolated.

17-point protection list

1. 01

   Remove WordPress version number

   Conceals the WordPress version to prevent targeted attacks on known vulnerabilities.

2. 02

   Remove version numbers from scripts and styles

   Prevents exploitation of vulnerabilities in outdated or specific library versions.

3. 03

   Restrict REST API

   Limits exposure of sensitive data and unauthorized API access.

4. 04

   Disable XML-RPC

   Stops brute force attacks, DoS, and exploitation of XML-RPC-related vulnerabilities.

5. 05

   CSP nonces

   Generates and applies Content Security Policy nonces to mitigate cross-site scripting by only allowing approved scripts.

6. 06

   Subresource Integrity (SRI)

   Adds SRI for specific scripts to ensure that only untampered scripts and styles are loaded.

7. 07

   Set Referrer-Policy header

   Protects user privacy by limiting how much referral information is shared with external sites.

8. 08

   Set Permissions-Policy header

   Restricts browser feature access, such as camera or microphone, to prevent unauthorized use.

9. 09

   Disable WP Admin dashboard

   Protection even if the admin panel is accessed by an attacker and they gain admin privileges.

10. 10

    Enforce HTTPS with Strict-Transport-Security

    Ensures all communications are encrypted, preventing man-in-the-middle attacks.

11. 11

    Remove X-Powered-By header

    Conceals technology stack information to reduce the risk of targeted attacks.

12. 12

    Disable file editing in WP Admin

    Prevents tampering or injection of malicious code by unauthorized or compromised admin accounts.

13. 13

    Disable plugin and theme installation

    Blocks unauthorized installation of potentially insecure or malicious plugins and themes.

14. 14

    Disable direct file editing

    Reduces risk of malicious code being directly injected via the WordPress dashboard.

15. 15

    Force HTTPS

    Ensures secure data transmission by encrypting all traffic.

16. 16

    Back up functions.php

    Backs up the original functions.php file during activation, providing a fallback to restore site functionality.

17. 17

    Restore option

    Simplifies recovery from errors or malicious changes to the functions.php file.

The full report for 2.0 is not ready yet. Until then, the WP-KeepSoul v1 page links to the 1.0 report.