Introduction:
WordPress is one of the most popular content management systems globally, but its widespread use makes it a frequent target for security breaches, login attacks, and plugin misuse.
This project addresses the need for lightweight, customizable security tools for WordPress admins. The goal was to build a plug in that could proactively audit login behavior, capture administrative actions, provide real-time security alerts, and introduce basic malware scanning—all in a deployable, easy-to-use format.
Background & Motivation
As WordPress continues to dominate website platforms, it increasingly becomes a target for brute-force login attacks, plugin vulnerabilities, and unauthorized admin activities.
Many existing security plugins are either overly complex or resource-heavy.
This project was motivated by the need for a lightweight, audit-focused, user-friendly tool that administrators could deploy without heavy technical expertise.
Personal motivation also stemmed from an interest in cybersecurity principles applied in real-world systems like CMS platforms, blending theory with practical application.
Security Alerts: Sends real-time alerts after 3 failed login attempts via email and/or Discord/Slack webhook.
reCAPTCHA Integration: Adds Google reCAPTCHA to the login screen to block bots.
CSV Export: Download login activity as a CSV for archiving or compliance.
Search & Pagination: Search logs by username or IP, with clean pagination for navigation.
Methodology / Approach
- Platform: WordPress CMS
- Development Tools: PHP, MySQL, WordPress plugin framework, reCAPTCHA v2, IPInfo.io API
- Key Features Developed:
- Login Audit Logging (successful & failed logins)
- Administrative Action Logging (plugin activation/deactivation/deletion)
- CSV Export Functionality for Audit Logs
- Configurable Email & Webhook Alerts
- reCAPTCHA Integration to Block Automated Bots
- Pagination and Search for Viewing Logs
- Basic Recursive Malware Scanner (checks PHP files for suspicious code)
Results & Findings
- Successfully built a deployable WordPress plugin
- Implemented flexible alert system (email, webhook, or both) for admin security.
- Login attempts and admin actions are logged accurately with IP address, timestamp, and region information.
- Basic malware scanner detects suspicious PHP file contents recursively across the server.
- Plugin compatible with WordPress 6.x and lightweight enough for small to medium websites.
Please leave your comments or questions below regarding my Capstone project.
3 responses to “Capstone Project: WP Security Plugin”
-
Really impressive work,will help with users in wordpress
-
Really awesome project and great pitch, very insightful on topics I didn’t understand at first.
-
Istvan presented information in a cohesive format. His presentation was clear and concise.
Leave a Reply