Security Center – Security Plugin for WordPress

Security Center is a simple security plugin for WordPress that does a few important jobs and does them quietly. It limits failed logins, keeps a list of recent failed attempts, adds three common security headers and lets you switch off XML-RPC. There is one short settings screen and nothing to learn.

It is made for site owners who want the basics in place without a heavy suite of dozens of screens. It works with any theme on any WordPress site, from a small blog to a busy online shop. It is a Themeve plugin, so it comes with a licence and updates through your Themeve account.

Why you need a security plugin for WordPress login pages

Every WordPress site has a login page, and bots know where to find it. They try common usernames and passwords again and again. Most attempts fail, but thousands of them waste server power and can slow your site for real visitors.

A strong password is your first defence. Limiting how many guesses a bot can make is the second. Security Center handles the second part for you, without any setup.

Who can use this security plugin for WordPress website owners

• Shop owners who handle orders and customer details
• Bloggers and news sites with several authors
• Business sites that are rarely updated and easy to forget
• Agencies who manage many small client sites
• Anyone who wants a clear, light plugin instead of a large security suite

What Security Center does

Login limit

After five failed logins from the same IP address, Security Center stops that address from trying again. The visitor sees the message that there were too many failed login attempts and should try again later. The count is kept for 15 minutes, so a real person who mistyped a password a few times can come back soon. A bot that guesses hundreds of passwords is stopped after five.

• Works on the normal WordPress login form
• Five failed attempts allowed per IP address
• The count is kept for 15 minutes
• Switched on as soon as your licence is active, with no setting to find

Failed login log

Each failed login is recorded with the time, the username that was tried and the IP address. The plugin keeps the latest 100 entries and shows the newest 20 on its settings screen. If you see the same username tried many times, you know someone is guessing, and you can change that username or strengthen the password.

Security headers

Security headers are short instructions your site sends to browsers. When you tick the option, Security Center sends three of them.

• X-Frame-Options (SAMEORIGIN): stops other sites from loading your pages inside a frame, which protects visitors from click tricks.
• X-Content-Type-Options (nosniff): tells browsers not to guess file types.
• Referrer-Policy (strict-origin-when-cross-origin): controls how much of your page address is shared when a visitor follows a link to another site.

Headers can clash with embedded content or third-party services, so test your pages after you switch them on.

Switch off XML-RPC

XML-RPC is an older way for apps to talk to WordPress. Most sites no longer need it, but password-guessing bots still target it. One tick turns it off. If you use an app or a service that needs XML-RPC, leave it on.

Back-end settings, screen by screen

The plugin adds one screen under Settings, called Themeve Security Center. Only administrators can open it. It has three parts.

Settings card

• Security headers: a checkbox. Tick it to send the three headers on your pages.
• Disable XML-RPC: a checkbox. Tick it to turn XML-RPC off.
• Save settings: saves both options.

Both checkboxes start empty, so nothing changes until you decide. The login limit does not need a checkbox, because it is always on once the plugin is licensed.

Licence card

A short note and a button that opens the Themeve licence screen. Use it to enter or check your licence for this website.

Recent failed logins

A table with three columns: time, username and IP address. It lists the 20 newest failed attempts. If there are none, it says no events were logged.

Locked screen without a licence

Until your licence is active, the plugin does nothing on your site. You see a lock icon in the dashboard menu, a Security Center screen with an Enter licence button, and the licence screen. After activation, the settings open.

What visitors see on the front end

Security Center has no visible design on your site. Normal visitors notice nothing. These are the only changes:

• A visitor who fails to log in five times sees the too many attempts message.
• If you tick the headers option, browsers receive three extra headers with each page. Visitors do not see them.
• If you tick the XML-RPC option, apps that call XML-RPC are refused.

What Security Center does not do

Security Center covers login protection, headers and XML-RPC. It is not a malware scanner and it is not a firewall. For a small site, these basics close common doors. For a high-traffic site, combine them with protection from your hosting company.

Good habits still matter most: strong and unique passwords, regular updates for WordPress, themes and plugins, and backups that you have tested.

How to read the failed login table

The table is short on purpose, but it tells you a lot. Look at the usernames first. If you see admin, administrator or the name of your business again and again, bots are guessing the usual names. Rename any account that uses such a name, and use a strong password on every account.

Next, look at the IP addresses. A few addresses repeating many times is a normal bot pattern, and the login limit already stops them after five tries. If one of your own staff appears, they probably mistyped a password. Ask them to use the reset link instead of guessing.

The time column shows when attempts happened. A burst at night is common, because bots run when nobody is watching. Check the table once a week, or after you notice the site slowing down.

Safe settings for different websites

• Online shop: keep the login limit on and tick the headers option. Test the checkout and any payment popup afterwards, because a payment service that loads inside a frame on your page may need the headers off.
• Blog or news site: tick both options. Test pages with embedded videos or maps after you save.
• Business site with a mobile app: leave XML-RPC on if the app needs it, and use the login limit and strong passwords.
• Client sites you manage: install it on each site, enter the licence for that site and check the table when you do routine updates.

The plugin uses the IP address your server reports. If your site sits behind a proxy or a content network, ask your host whether the real visitor address is passed on, so that one blocked bot does not look the same as a real customer.

Habits that work well with it

• Use long, unique passwords for every admin and editor.
• Do not use admin as a username.
• Give each staff member their own account and remove it when they leave.
• Give freelancers a temporary account and delete it after the job.
• Keep WordPress, your theme and every plugin updated.
• Delete plugins you no longer use.
• Keep backups somewhere other than your hosting.

Two other Themeve plugins fit well here. Activity Log records logins, content changes and plugin activation with user and time. User Role and Access Manager helps you give staff only the access they need.

A quick example

Think of Security Center as a simple security plugin for WordPress that sits at the door and counts mistakes. Here is how that looks in a real case.

A small shop owner notices the site is slow every night. After installing Security Center, the failed login table shows many attempts from a handful of addresses. Each address is stopped after five tries. The owner also ticks the XML-RPC option and renames the admin user. The night-time slowdowns ease.

Setup steps

Setting up this security plugin for WordPress takes about five minutes.

1. In the WordPress dashboard, open Plugins, Add New, Upload Plugin and choose the Security Center zip file.
2. Click Install Now, then Activate.
3. Open the Security Center screen and click Enter licence. Activate your licence from My Account, Licenses.
4. Go to Settings, Themeve Security Center.
5. Tick Security headers if you want them, and open your key pages to check that embeds still work.
6. Tick Disable XML-RPC if you do not use apps that need it.
7. Click Save settings.
8. Check the Recent failed logins table after a few days.

WordPress 6.2 or newer and PHP 7.4 or newer are required. Updates arrive in Dashboard, Updates while your licence is active.

Why choose this security plugin for WordPress

Large security suites bring scanners, firewalls and dashboards that many small sites never use. They can also be heavy to run. Security Center keeps to the basics.

• One short settings screen
• Login limit active from the start
• Clear list of failed attempts
• Options off until you tick them
• Works with any theme
• Updates through your Themeve account

If you run more than one site, remember that each site needs its own licence. The plugin then works as a light security plugin for WordPress website projects of any size, from a personal blog to a client shop, and every site keeps its own settings and its own failed login table.

What is included

• Security Center plugin (version 1.0.1)
• Login limit, failed login log, security headers and XML-RPC switch
• Updates through your Themeve account
• Friendly WhatsApp support

Security Center is built on the official WordPress documentation standards, and you can browse more of our WordPress plugins.