Your forms keep working
The form endpoints stay reachable from anywhere. List the exact action names your site uses, and allow the REST routes your chat calls.
Bots don't care that nobody visits your WordPress.
They hit the same doors on every WordPress site, all day, whether anyone uses them or not. Bunker isn't about hiding that WordPress is there. It closes the doors that get hit.
Password guessing
Endless login attempts on the login page and through XML-RPC.
Username hunting
Author scans and the users API, to learn who to guess passwords for.
PHP in uploads
A dropped file in the uploads folder, run straight from a web address.
Spam and sign-ups
Comment spam, fake registrations and leftover REST endpoints.
What it locks down
Open Settings › Bunker. One checkbox per lockdown, each with a plain-language description that flips to say what just happened when you untick it.
- Hides the WordPress front end with a plain 404
- Blocks XML-RPC
- Locks the REST API, except routes you allow
- Hides usernames from scans, the API and login errors
- Turns off comments, pingbacks and trackbacks
- Turns off public registration
- Turns off application passwords
- Locks the login page and dashboard to your IP addresses
- Turns off the built-in code editors
- Hides version files, logs and folder listings
- Blocks PHP in the uploads folder
- Warns you when scheduled tasks stall
- Lets through only the form actions you list (optional)
- Answers 404 to everything WordPress-related (optional)
Locked down, without locking yourself out
Your forms keep working, you keep a spare key, and nothing changes until you've said it's right for your site.
A spare key, the hatch link
Address changed? Open your hatch link and Bunker emails you. Only after you press Approve is that browser let in, for 1 to 24 hours.
Nothing happens until you say so
Bunker enforces nothing until you choose Lock it down, and the IP lock waits until you've reviewed and saved your list.
Know when something important changes
Three optional email alerts, all off until you tick them. They work on any site, even before you lock anything down.
A new administrator
An account is created as, promoted to or given the administrator role. One email for each grant.
A new plugin
Installed through WordPress by upload, the plugin directory or WP-CLI. Updates, reinstalls and failed installs stay quiet.
A new theme
The same for themes. Send alerts to the site address or to any address you choose, separate from your hatch approvals.
Alerts cover changes made through WordPress, not files copied over SFTP, and they report rather than prevent.
Easy to switch on. Easy to switch off.
- Off pauses everything
- Safe-mode line
- Old rules restored on errors
- No visitor logging
Switch Bunker Off and every lockdown pauses and its server rules come out, with your settings kept. One line in wp-config.php does the same if you can't reach the dashboard. Server rules live between clearly marked lines, and if your server answers with an error after a change, Bunker puts the old file straight back.
Bunker makes no outside requests except update checks against this project's GitHub releases. It is not a firewall, malware scanner, login limiter or two-factor plugin. If you think your site has been hacked, The Hack Repair Guy can help.
Even better: give WordPress its own address
If your static homepage sits in the same folder as WordPress, a break-in could rewrite it. Bunker spots this and explains how to move WordPress to its own subdomain or hosting account, so your public site stays out of reach.
Install it in a minute
- Download the zip from the button below.
- In WordPress, open Plugins › Add New › Upload Plugin, choose the zip and activate it.
- Open Settings › Bunker, untick anything your static site still needs, and choose Lock it down.
- Review your IP list, choose Save list, then test your site's form.
Download Bunker
Free, and later updates arrive on the normal Plugins screen.