Title: Flex Website Security Author: Flex Plugins Published: Setyembre 2, 2026 Last modified: Setyembre 16, 2026 --- Maghanap ng mga plugin ![](https://ps.w.org/flex-website-security/assets/banner-772x250.png?rev=3677424) ![](https://ps.w.org/flex-website-security/assets/icon-256x256.png?rev=3677349) # Flex Website Security Ni [Flex Plugins](https://profiles.wordpress.org/flexfields/) [I-download](https://downloads.wordpress.org/plugin/flex-website-security.1.2.4.zip) * [Mga Detalye](https://tl.wordpress.org/plugins/flex-website-security/#description) * [Mga Review](https://tl.wordpress.org/plugins/flex-website-security/#reviews) * [Pag-install](https://tl.wordpress.org/plugins/flex-website-security/#installation) * [Development](https://tl.wordpress.org/plugins/flex-website-security/#developers) [Suporta](https://wordpress.org/support/plugin/flex-website-security/) ## Deskripsyon **Flex Website Security** is a lightweight hardening toolkit — not a full WAF or malware scanner. It reduces common attack surfaces: brute-force logins, XML-RPC abuse, user enumeration, and loose admin defaults. * Limit failed login attempts, with a lockout list you can unblock immediately * Permanently block or unblock IPs * Restrict by country: Allow from or Restrict from, on the whole site or admin only * Custom login URL and hide wp-admin for guests * Optional Cloudflare Turnstile or Google reCAPTCHA on login forms * Login honeypot and generic login errors * Disable XML-RPC and the theme/plugin file editor * Hide WordPress version * Block user enumeration * Basic security headers (HSTS is left to Flex SSL) Admin CSS and JavaScript ship with the plugin. Remote scripts and API calls run only when you enable captcha or the optional country lookup. #### Privacy IP lockouts and permanent blocks are stored in your WordPress database. Only administrators can view or change them on **Flex Website Security Access**. **Captcha** (off by default): if you choose Cloudflare Turnstile or Google reCAPTCHA and save both keys, the login form loads that provider’s script and sends the visitor IP plus the captcha token to the provider for verification. **Country lookup** (off by default): country rules first use CDN headers (Cloudflare, CloudFront, and similar). If you enable the optional geojs.io lookup, public visitor IPs without a header are sent to geojs.io and cached for 7 days. See **Third-party services** below for URLs, terms, and privacy policies. ### Third-party services These services are optional and off by default. No third-party script is loaded unless you choose a captcha provider and save both keys, or you enable the geojs. io lookup. #### Cloudflare Turnstile When enabled, the login form loads `https://challenges.cloudflare.com/turnstile/ v0/api.js` and verifies tokens at `https://challenges.cloudflare.com/turnstile/v0/ siteverify`. Cloudflare receives the visitor IP and token. * Service: [https://www.cloudflare.com/application-services/products/turnstile/](https://www.cloudflare.com/application-services/products/turnstile/) * Terms: [https://www.cloudflare.com/website-terms/](https://www.cloudflare.com/website-terms/) * Privacy: [https://www.cloudflare.com/privacypolicy/](https://www.cloudflare.com/privacypolicy/) #### Google reCAPTCHA When enabled, the login form loads `https://www.google.com/recaptcha/api.js` and verifies tokens at `https://www.google.com/recaptcha/api/siteverify`. Google receives the visitor IP and token. * Service: [https://www.google.com/recaptcha/about/](https://www.google.com/recaptcha/about/) * Terms: [https://policies.google.com/terms](https://policies.google.com/terms) * Privacy: [https://policies.google.com/privacy](https://policies.google.com/privacy) #### geojs.io When enabled on Access, visitor IPs without a CDN country header are looked up at` https://get.geojs.io/v1/ip/country/{ip}` and cached for 7 days. * Service: [https://www.geojs.io/](https://www.geojs.io/) * Terms / privacy: [https://www.geojs.io/](https://www.geojs.io/) ### License Flex Website Security is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 2 of the License, or (at your option) any later version. For more details, see https://www.gnu.org/licenses/gpl-2.0.html. ## Pag-install 1. Upload the `flex-website-security` folder to `/wp-content/plugins/`, or install the zip via **Plugins Add New Upload Plugin**. 2. Activate **Flex Website Security**. 3. Go to **Flex Website Security Settings** and save the hardening options you need. 4. Optional: **Login page** for a custom login URL and captcha. 5. Optional: **Access** for lockouts, permanent IP blocks, and country rules. 6. Open **Audit** to confirm which protections are on. ## FAQ ### Is this a firewall or malware scanner? No. Flex Website Security turns on common hardening options. Pair it with Flex SSL for HTTPS and HSTS, and keep WordPress, themes, and plugins updated. ### What if I lock myself out of a custom login URL? Add `define( 'FLEX_SECURITY_DISABLE_CUSTOM_LOGIN', true );` to wp-config.php, or rename the plugin folder over SFTP. Bookmark the new login URL before you log out. ### What if a country rule blocks the site or login? Add `define( 'FLEX_SECURITY_DISABLE_COUNTRY_BLOCK', true );` to wp-config.php, then fix Mode, Apply to, or the country list on **Access**. Whole website mode still allows the login form so you can sign in and change the rule. Admin-only mode restricts login and wp-admin for guests. ### Does Clear lockouts remove permanent IP blocks? No. It removes temporary failed-login lockouts only. Permanent blocks stay until you Unblock them on Access. ### Do captcha failures count toward lockout? No. Failed captcha checks do not increment the attempt counter. ### Will this break Jetpack or a mobile app? Disabling XML-RPC or Application Passwords can affect older apps and some Jetpack features. Turn those options off if you still need them. ### What happens when I uninstall? Deleting the plugin removes settings, IP lockouts/blocks, and country lookup cache. It does not remove `DISALLOW_FILE_EDIT` if you defined that constant yourself in wp-config.php. ## Mga Review Wala pang reviews para sa plugin na ito. ## Mga Contributor at Developer Ang “Flex Website Security” ay open source software. Ang mga sumusunod na tao ay nag-ambag sa plugin na ito. Mga Contributor * [ Flex Plugins ](https://profiles.wordpress.org/flexfields/) * [ Flex Dev ](https://profiles.wordpress.org/hovoqoch/) [Isalin ang “Flex Website Security” sa iyong wika.](https://translate.wordpress.org/projects/wp-plugins/flex-website-security) ### Interesado sa development? [Tingnan ang code](https://plugins.trac.wordpress.org/browser/flex-website-security/), i-check ang [SVN repository](https://plugins.svn.wordpress.org/flex-website-security/), o mag-subscribe sa [development log](https://plugins.trac.wordpress.org/log/flex-website-security/) sa pamamagitan ng [RSS](https://plugins.trac.wordpress.org/log/flex-website-security/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.2.4 * About FLEX lists the full suite, including Flex Clone and FLEX SMM & SEO. #### 1.2.3 * Renamed the plugin to Flex Website Security (slug flex-website-security). #### 1.2.2 * Removed Plugin URI for now. Author URI remains https://flexible.am/. #### 1.2.1 * WordPress.org review readiness: complete readme (privacy, installation, FAQ, service terms) and Plugin URI. * Tested up to WordPress 7.1. * Fixed Access Clear lockouts (it required an IP in the URL and never ran). #### 1.2.0 * Added Access: view lockouts, permanently block or unblock IPs immediately, and country allow/restrict rules (whole site or admin only). #### 1.1.0 * Added Login page: custom login URL, hide wp-admin for guests, Turnstile and reCAPTCHA. #### 1.0.0 * Initial release. ## Meta * Bersyon **1.2.4** * Huling na-update **2 linggo ang nakalipas** * Mga aktibong installation **Wala pang 10** * Bersyon ng WordPress ** 6.2 o mas bago ** * Sinubukan hanggang **7.1.2** * Bersyon ng PHP ** 7.4 o mas bago ** * Wika * [English (US)](https://wordpress.org/plugins/flex-website-security/) * Mga Tag * [login](https://tl.wordpress.org/plugins/tags/login/)[recaptcha](https://tl.wordpress.org/plugins/tags/recaptcha/) [security](https://tl.wordpress.org/plugins/tags/security/)[turnstile](https://tl.wordpress.org/plugins/tags/turnstile/) [xml-rpc](https://tl.wordpress.org/plugins/tags/xml-rpc/) * [Advanced View](https://tl.wordpress.org/plugins/flex-website-security/advanced/) ## Mga Rating No reviews have been submitted yet. [Ang iyong review](https://wordpress.org/support/plugin/flex-website-security/reviews/#new-post) [Tingnan lahat ng mga review](https://wordpress.org/support/plugin/flex-website-security/reviews/) ## Mga Contributor * [ Flex Plugins ](https://profiles.wordpress.org/flexfields/) * [ Flex Dev ](https://profiles.wordpress.org/hovoqoch/) ## Suporta May gusto kang sabihin? Kailangan ng tulong? [Tingnan ang support forum](https://wordpress.org/support/plugin/flex-website-security/)