Hopelessly Sensible
A free, GPL WordPress security plugin that does seven things, explains each one in plain English, and stands down when it should.
Ø1 Problem
Most WordPress security plugins are heavy, noisy and built to upsell: scans, scores, badges, and a dashboard full of things to buy. Most real-world break-ins are not sophisticated. They are bots trying the same unlocked doors on every site: usernames leaked by the REST API, login errors that confirm a username exists, XML-RPC, comment spam, the file editor. Small site owners need those doors closed and do not need a security career to do it.
Ø2 Solution
Seven switches. Each has a plain-English explanation of what it does and an honest note about what it might break. On activation the plugin inspects the site and turns on only what is safe there. Three switches that take something away from the owner are never turned on automatically. And if a setting stops being safe, because a new plugin needs XML-RPC or a theme starts running PHP through the file editor, the plugin stands down by itself and shows one dismissible notice saying what changed and why. That is the only thing it ever shows outside its own settings screen.
Ø3 Delivery
Published free on WordPress.org by Hebble & Stone CIC, with me as contributor. It is as small as I could make it: no runtime dependencies, no autoloader, no JavaScript anywhere, one option row, and a registry that drives defaults, sanitising, the settings screen and the REST schema from a single source of truth. Scope discipline is the product: the README lists the features we considered and declined.
Notes from the build
- 109 tests run against the real WordPress core test suite, and again against WordPress 6.5 before every release.
- Auto-standdown runs on wp_loaded, the first moment every plugin has declared what it needs.
- Schema upgrades add new features switched off, so an update never changes a live site's behaviour.
- WooCommerce reviews are comments in disguise. They get their own switch so closing comments never destroys star ratings.
- Full WordPress Coding Standards, a 60-entry gotchas document, and a lint that bans em-dashes in UI copy.
