Rythzen Security

Name: Rythzen Security
Author: Rythzen

Security

Hardening and visibility, without the dashboard nagware.

Lightweight WordPress security hardening, login protection, audit logging, file integrity scanning, and security diagnostics by Rythzen.

Latest release

1.1.2

20 Aug 2026 · 54 KB

Download 1.1.2

Requires WordPress: 6.5
Requires PHP: 7.4
Tested up to: 7.1
Licence: GPL-2.0-or-later
Downloads: 46

Automatic updates are built in. Install once, enable auto-updates on the WordPress Plugins screen, and new releases arrive on their own.

Rythzen Security covers the handful of things that actually matter on a small WordPress site: stopping password guessing, noticing when core files change, and keeping a record of who did what.

It does not sell you a firewall subscription and it does not put a red badge in your dashboard to upsell you. Every finding comes with the reason it was raised.

Screenshots

Captured on WordPress 7.1. Click any image to view it full size.

The scanner compares core files against the official WordPress checksums and explains why each finding was raised.

Login throttling, the visitor-IP source, integrity scanning and security headers — every option with the reason it exists.

The Updates screen: what is installed, what is available, and the release channel this site follows.

What it does

Brute-force login throttling with a trusted-IP allowlist
Correct visitor IP behind Cloudflare and other proxies
File integrity scanning against official WordPress checksums
An audit log of logins, role changes, plugin and theme activity
REST user-enumeration blocking and pingback hardening
Security headers including optional HSTS

Installing Rythzen Security

1. Download the zip from this page.
2. In WordPress, go to Plugins → Add New → Upload Plugin and choose the file.
3. Activate, then open Rythzen Security → Settings.
4. If your site sits behind Cloudflare, set "Visitor IP source" to match — otherwise login lockouts will apply to the proxy rather than the attacker.
5. Run a scan from the dashboard.

1.1.2
Current20 Aug 2026
* Declared compatibility with WordPress 7.1, the version this release was verified on.
* Corrected the readme stable tag, which still pointed at 1.0.0.
1.1.1
20 Aug 2026
Fixed: the admin menu icon was supplied as a raw 512x512 PNG, which WordPress rendered at
full size in the sidebar — it covered the screen and intercepted clicks intended for the page
underneath. It is now a properly sized SVG that follows your admin colour scheme.
1.1.0
20 Aug 2026
Added: self-hosted automatic updates through the new Rythzen update service.
Added: an Updates screen showing the installed and latest version, release channel and last check.
Security: added a "Visitor IP source" setting for sites behind Cloudflare or another proxy.
Previously only the connection address was read, so behind a CDN every visitor shared one IP and
a single attacker's failed logins could lock out every legitimate visitor.
Fixed: the file scanner reported the harmless "Silence is golden" index.php stubs that WordPress
and caching plugins place in generated folders. Running Rythzen Cache alongside this plugin
produced a permanent false high-severity finding.
Fixed: audit events were still being written after audit logging had been switched off.
Fixed: the log cleanup task kept firing with no handler attached once audit logging was disabled.
Improved: the core checksum scan now says when it stopped early instead of presenting partial
counts as totals.
1.0.0
20 Aug 2026
* Initial release.

Version	Released	Channel	Size	Requires	Downloads	Package
1.1.2 LATEST	20 Aug 2026	stable	54 KB	WP 6.5 · PHP 7.4	20	Download
1.1.1	20 Aug 2026	stable	54 KB	WP 6.5 · PHP 7.4	12	Download
1.1.0	20 Aug 2026	stable	53 KB	WP 6.5 · PHP 7.4	7	Download
1.0.0	20 Aug 2026	stable	45 KB	WP 6.5 · PHP 7.4	7	Download

Older releases stay available so you can roll back if an update ever causes a problem on your site. Verify any package you download against its SHA-256 checksum below.

SHA-256 checksums

1.1.2cb137fa30ab1831ee66e1c6bde6573e7a59c58d4b31eeda4e0c4d65eba4f0f81
1.1.18b0e6c2603a735da6a64c76b87b10759557e1ed879565351efdb4addaebd2eb2
1.1.0adab67c2486d763252a11100a7f7c399092ae30e5021cd7a1ed11525a4769cdd
1.0.01ac861377bce255cb5be67f11ccc9317d70e389736d369e1ac0ef39cdba3aea8

I use Cloudflare. Why is that a problem?

Behind a proxy every request arrives from the proxy address, so an unconfigured lockout blocks Cloudflare rather than the attacker — and eventually everyone. Set "Visitor IP source" to match your proxy before enabling login throttling.

What happens if I lock myself out?

Add your address to the trusted-IP allowlist before you start testing. If you are already locked out, the lockout expires on its own, and deleting the plugin's options row clears it immediately.

Does the scanner report the whole site?

It stops after the first twenty findings and says so on screen. A truncated list that admits it is truncated is more useful than one that looks complete.

Is this a firewall?

No. It covers password guessing, file integrity, an audit trail and security headers. There is no traffic filtering, no malware removal service and no subscription — if you need a WAF, put one in front of the site.

Will enabling HSTS lock visitors out of HTTP?

That is what HSTS does — browsers refuse plain HTTP for the duration you set. Turn it on only once HTTPS works on every hostname the site answers to, including www.

Rythzen Security

Screenshots

Installing Rythzen Security

1.1.2

1.1.1

1.1.0

1.0.0

SHA-256 checksums