{"id":364661,"date":"2026-09-09T16:15:17","date_gmt":"2026-09-09T16:15:17","guid":{"rendered":"https:\/\/es.wordpress.org\/plugins\/cerrojo-security-toolkit\/"},"modified":"2026-09-09T16:14:55","modified_gmt":"2026-09-09T16:14:55","slug":"cerrojo-security-toolkit","status":"publish","type":"plugin","link":"https:\/\/ky.wordpress.org\/plugins\/cerrojo-security-toolkit\/","author":23560812,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"0.2.2","stable_tag":"0.2.2","tested":"7.1","requires":"6.8","requires_php":"8.1","requires_plugins":null,"header_name":"Cerrojo Security Toolkit","header_author":"Carlos Carrillo","header_description":"Defense-in-depth security diagnostics and reversible hardening tools for WordPress.","assets_banners_color":"","last_updated":"2026-09-09 16:14:55","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"https:\/\/github.com\/carlose119\/bastion-security-wp","header_author_uri":"","rating":0,"author_block_rating":0,"active_installs":0,"downloads":41,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"0.2.2":{"tag":"0.2.2","author":"carlose119","date":"2026-09-09 16:14:55","revision":3688652}},"upgrade_notice":[],"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3688710,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3688710,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256},"icon.svg":{"filename":"icon.svg","revision":3688710,"resolution":false,"location":"assets","locale":false}},"assets_banners":[],"assets_blueprints":{},"all_blocks":[],"tagged_versions":["0.2.2"],"block_files":[],"assets_screenshots":[],"screenshots":[]},"plugin_section":[],"plugin_tags":[31093,1229,23853,600,153786],"plugin_category":[54],"plugin_contributors":[279968],"plugin_business_model":[],"class_list":["post-364661","plugin","type-plugin","status-publish","hentry","plugin_tags-hardening","plugin_tags-login-security","plugin_tags-rest-api","plugin_tags-security","plugin_tags-security-headers","plugin_category-security-and-spam-protection","plugin_contributors-carlose119","plugin_committers-carlose119"],"banners":[],"icons":{"svg":"https:\/\/ps.w.org\/cerrojo-security-toolkit\/assets\/icon.svg?rev=3688710","icon":"https:\/\/ps.w.org\/cerrojo-security-toolkit\/assets\/icon.svg?rev=3688710","icon_2x":false,"generated":false},"screenshots":[],"raw_content":"<!--section=description-->\n<p>Cerrojo Security Toolkit adds focused security diagnostics and reversible, opt-in controls under Tools &gt; Cerrojo Security Toolkit.<\/p>\n\n<p>Current tools include:<\/p>\n\n<ul>\n<li>Security posture diagnostics with links to native WordPress Site Health.<\/li>\n<li>A file editor control that stores a plugin preference without editing wp-config.php.<\/li>\n<li>Best-effort login protection with temporary, progressive throttling.<\/li>\n<li>XML-RPC pingback protection that removes native inbound pingback methods and the WordPress-filtered X-Pingback header.<\/li>\n<li>Staged HTTP security header policies with baseline, optional groups, compatibility warnings, and rollback controls.<\/li>\n<li>Email alerts for supported plugin installation and activation events.<\/li>\n<li>Email alerts for supported administrator account lifecycle events.<\/li>\n<li>URL Change Alerts for supported successful local WordPress Address and Site Address updates.<\/li>\n<li>Selective REST API blocking by HTTP method and registered route template. Matching rules apply to all callers, including administrators and authenticated integrations.<\/li>\n<\/ul>\n\n<p>Controls are designed to be reviewed, enabled, verified, and reversed individually. Coverage depends on the WordPress hooks and serving paths described in each tool. Login throttling is best-effort, email delivery depends on the site's mail transport, and headers must be verified at every cache, proxy, CDN, and origin edge.<\/p>\n\n<p>Cerrojo Security Toolkit is not a web application firewall or malware scanner. It does not certify a site or guarantee complete protection. Use it as one layer in a broader security and recovery plan.<\/p>\n\n<p>Saved settings remain until you change them. Deactivation stops the plugin's runtime behavior but preserves its settings, metrics, and temporary state. The plugin currently provides no uninstall cleanup routine.<\/p>\n\n<!--section=installation-->\n<ol>\n<li>Upload the plugin files to <code>\/wp-content\/plugins\/cerrojo-security-toolkit\/<\/code>, or install the plugin through the WordPress Plugins screen.<\/li>\n<li>Activate Cerrojo Security Toolkit through the Plugins screen.<\/li>\n<li>Open Tools &gt; Cerrojo Security Toolkit.<\/li>\n<li>Review the diagnostics before enabling controls.<\/li>\n<li>Enable one control at a time, verify site behavior and integrations, and keep an independent recovery path available.<\/li>\n<\/ol>\n\n<!--section=faq-->\n<dl>\n<dt id=\"does%20cerrojo%20security%20toolkit%20guarantee%20that%20my%20site%20is%20secure%3F\"><h3>Does Cerrojo Security Toolkit guarantee that my site is secure?<\/h3><\/dt>\n<dd><p>No. It provides diagnostics and bounded hardening controls. It is not a WAF, malware scanner, certification, or complete protection guarantee.<\/p><\/dd>\n<dt id=\"can%20i%20reverse%20the%20settings%3F\"><h3>Can I reverse the settings?<\/h3><\/dt>\n<dd><p>Yes. The settings UI provides controls to disable or clear plugin-managed policies. Some effects outside WordPress, such as an HSTS policy already remembered by a browser or email already handed to a mail server, cannot be recalled immediately.<\/p><\/dd>\n<dt id=\"who%20is%20affected%20by%20a%20blocked%20rest%20route%3F\"><h3>Who is affected by a blocked REST route?<\/h3><\/dt>\n<dd><p>Every caller whose request matches the selected HTTP method and registered route template. There are no administrator, capability, cookie, or Application Password exemptions.<\/p><\/dd>\n<dt id=\"what%20do%20url%20change%20alerts%20observe%3F\"><h3>What do URL Change Alerts observe?<\/h3><\/dt>\n<dd><p>URL Change Alerts are independently opt-in under Tools &gt; Cerrojo Security Toolkit &gt; Hardening. Enable the tool, enter one to 50 valid recipient addresses separated by commas or new lines, and save. There is no administrator-email fallback and no reuse of recipients from another alert tool. Disabling preserves recipients for a later re-enable.<\/p>\n\n<p>The tool observes only successful update_option_home and update_option_siteurl hooks for the existing home and siteurl settings in the current local-blog context. They are separate settings, so each successful update is a separate event. It does not observe option additions, deletions, network options, direct SQL or file changes, or scheduled scans, and it does not switch sites or fan out on multisite.<\/p>\n\n<p>A changed raw string is observed even when redaction or truncation makes the displayed references identical. Displayed values remove user information, query strings, and fragments; invalid values are Unavailable. Paths are retained when available and may be sensitive. Cerrojo makes one plain-text wp_mail attempt per recipient; an attempt is not delivery. Mail failures do not block a WordPress update or trigger automatic rollback.<\/p><\/dd>\n<dt id=\"does%20uninstalling%20remove%20saved%20data%3F\"><h3>Does uninstalling remove saved data?<\/h3><\/dt>\n<dd><p>No. This version has no uninstall cleanup routine, so plugin-owned settings remain unless they are changed or removed separately.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>0.2.2<\/h4>\n\n<ul>\n<li>Includes URL Change Alerts, which have been available on master since 0.2.1.<\/li>\n<li>Sanitized nonce input, scoped enqueued admin CSS, and replaced URL parsing with wp_parse_url().<\/li>\n<li>Renamed the plugin entrypoint and packaged plugin assets. Existing installations may need reactivation after the entrypoint rename.<\/li>\n<\/ul>\n\n<h4>0.2.1<\/h4>\n\n<ul>\n<li>Corrected the public name, text domain, and package slug to avoid an existing WordPress update identity collision.<\/li>\n<\/ul>\n\n<h4>0.2.0<\/h4>\n\n<ul>\n<li>Added an actionable security dashboard and staged HTTP security header policies.<\/li>\n<li>Added login protection and XML-RPC pingback protection.<\/li>\n<li>Added plugin activity and administrator account alerts.<\/li>\n<li>Added selective REST API blocking by HTTP method and registered route template.<\/li>\n<li>Improved WordPress.org packaging and directory compliance.<\/li>\n<\/ul>\n\n<h4>0.1.0<\/h4>\n\n<ul>\n<li>Initial release.<\/li>\n<\/ul>","raw_excerpt":"Review security diagnostics and apply reversible WordPress hardening controls with explicit compatibility guidance.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ky.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/364661","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ky.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/ky.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/ky.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=364661"}],"author":[{"embeddable":true,"href":"https:\/\/ky.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/carlose119"}],"wp:attachment":[{"href":"https:\/\/ky.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=364661"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/ky.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=364661"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/ky.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=364661"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/ky.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=364661"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/ky.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=364661"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/ky.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=364661"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}