WordPress, WooCommerce & Web Flaw Finder & Drop-In Shield.

What's Inside the 10-File ZIP Archive 19.9 KB

• mu-plugins/faultypacket-wp-shield.php — Blocks unauthenticated /wp-json/wp/v2/users enumeration (403), disables xmlrpc.php, strips ?ver= leaks, blocks ?author=N scans, and injects OWASP + PCI-DSS v4.0.1 Req 6.4.3 checkout CSP headers.
• mu-plugins/faultypacket-wp-mail-dkim-smtp.php — Lightweight phpmailer_init drop-in enforcing authenticated STARTTLS, Return-Path alignment, and matching Message-ID domains to cure Gmail/M365 550-5.7.26 receipt drops.
• server-configs/htaccess-apache-litespeed-wp-hardening.conf & nginx-wordpress-fastcgi-hardening.conf — Blocks /wp-content/uploads/*.php webshells, .env, wp-config.php.bak, and PHP2Shell (CVE-2026-109618).
• cloudflare-waf/cloudflare-wp-woocommerce-waf-expressions.txt — 3 copy-paste Cloudflare Free WAF rules protecting /wp-login.php & /wc-api/ while whitelisting Stripe & PayPal webhooks.
• pci-dss-v4-checkout/woocommerce-pci-dss-4.0.1-script-inventory-and-csp.csv + dns-deliverability/woocommerce-spf-dmarc-mta-sts-templates.txt + verify-wp-posture.sh / .ps1.

Interactive Output Preview (Zero Placeholders) Live Sample

/* /wp-content/mu-plugins/faultypacket-wp-shield.php (Excerpt) */
add_filter( 'xmlrpc_enabled', '__return_false', 9999 );
add_filter( 'rest_endpoints', function( $endpoints ) {
    if ( is_user_logged_in() && current_user_can( 'list_users' ) ) return $endpoints;
    $block = function() {
        return new WP_Error( 'fp_rest_user_enumeration_blocked',
            'Unauthenticated REST user enumeration blocked.', array( 'status' => 403 ) );
    };
    if ( isset( $endpoints['/wp/v2/users'] ) ) {
        foreach ( $endpoints['/wp/v2/users'] as $i => $h ) {
            $endpoints['/wp/v2/users'][$i]['permission_callback'] = $block;
        }
    }
    return $endpoints;
}, 9999 );