Case study
Hopelessly Sensible
Most WordPress security plugins are heavy, noisy, overly complex and built to upsell you: scans, scores, badges, and a dashboard full of mysterious stuff. But most real-world break-ins are not sophisticated. They are bots trying the same unlocked doors on every site. We wanted to give small site owners a way to get more secure, for free and not need an IT engineering degree to do so.
The brief
We set out to remove the bloat and the complexity from WordPress security plugins. We didn't try to "do it all": we aimed for simplicity and the kind of "set and forget" workflow that suits charity managers and small-business owners without on-call IT staff. We looked at seven of the most typical security "threat vectors" specifically affecting WordPress websites, and built for those.
Outcome
Hopelessly Simple, as the name suggests, does a few things and does them well. Seven things to be exact - each of them addressing the classic means by which automated bots and attackers can gain entry to your site.
- Keeps your list of users and their usernames away from anonymous visitors
- Gives the same short message whether a login failed due to the username or the password
- Hides author pages and keeps writers out of your sitemap and link previews
- Blocks XML-RPC, an old remote publishing interface popular with password-guessing tools
- Optionally: closes comments everywhere
- Optionally: closes WooCommerce product reviews
- Optionally: locks the theme and plugin file editors in the dashboard
Just as important though, is what the plugin does not do. It doesn't create myriad references to itself in your site database. It doesn't try to upsell anything to you. It doesn't phone home, add extraneous JavaScript to your pages, do anything behind your back or try to give you a spurious "security score".
And we made it available for free, to anyone who needs it on the WordPress.org plugin store. Just type Hopelessly Sensible into the search box in your Admin > plugins screen and you can add it to your site today. If you're interested in development, the source code is publicly available on GitHub here: https://github.com/Hebble-Stone-CIC/hopelessly-sensible
Basic security on your website shouldn't require an engineering degree. Get Hopelessly Sensible today, free forever.