RudiQ Shield v2 Free is a front-end visitor gate using:
- Browser SHA-256 proof-of-work (difficulty 1–4 leading zero hex chars)
- Signed HttpOnly cookie token (HMAC with WP salts)
- Challenge page for visitors without a valid token
- Skips admin, AJAX, REST, cron, login, logged-in admins
That pairs well with Version 1 form CAPTCHA:
| Layer | What it does |
|--------|----------------|
| Form CAPTCHA (current Rudix) | Protects login / register / lost password / comments |
| PoW visitor gate | Protects the whole front-end from scrapers/bots before the page loads |
Rename: `rudix-captcha` → `rudyq-shield` (plugin slug, text domain, option keys, CSS classes, etc.)
Security features in v2 (basic, high value)
1. Form CAPTCHA – intelligent number challenges on login, register, lost password, comments
2. Proof-of-work gate – optional site-wide visitor check (from the zip)
3. Rate limiting – per IP on forms + optional on challenge attempts
4. Honeypot + WP nonces + time window – already solid; keep them
5. Attribution integrity – keep fail-closed on login if link is stripped
Strong basic additions (still “free-tier friendly”)
6. XML-RPC control – disable or restrict `xmlrpc.php` (common attack surface)
7. Login protection
- Limit failed logins per IP / username
- Optional temporary lockout after N failures
- Optional hide/change login URL is possible but more fragile — better as optional/advanced
8. REST API hardening – require auth for sensitive routes; optionally disable user enumeration (`/wp-json/wp/v2/users`)
9. Security headers (toggleable)
- `X-Frame-Options` / `frame-ancestors`
- `X-Content-Type-Options: nosniff`
- `Referrer-Policy`
- Optional basic CSP starter
10. Disable file editing reminder / helper – `DISALLOW_FILE_EDIT` (document + optional constant check notice)
11. Application passwords / weak auth awareness – notices only, don’t force
12. Comment hardening – already have CAPTCHA; add optional “links limit” / “hold first comment for moderation” toggles
13. 404 / probe soft throttle – slow repeated hits on `wp-login.php`, `xmlrpc.php`, common plugin paths (without full WAF complexity)
14. Clean uninstall – already planned; keep
Useful but careful (optional / later)
15. Country / ASN block – needs GeoIP; heavier, more support cost
16. Full WAF rules – scope creep; better as Enterprise later
17. 2FA – valuable but large; usually separate plugin unless you want it in Shield
18. Malware scanner – not “basic”; needs continuous maintenance
RudyQ Shield (Free)
- Form CAPTCHA (all current surfaces)
- Optional PoW front-end gate
- Rate limit + honeypot + headers
- XML-RPC off/restrict
- Login failure limits
- User enumeration / REST soft hardening
- Clean uninstall
Pro / Enterprise (May be more options)
- IP log & block UI
- Geo rules
- Custom challenge branding
- Harder PoW / bot scoring
- License / multi-site
Implementation notes
- Merge PoW into one plugin: RudyQ Shield, not two plugins
- Shared options page: Forms | Front-end gate | Hardening | Headers
- PoW must stay off by default (easy to lock yourself out on misconfig)
- Exclude: `wp-login.php`, admin, cron, REST you need, AJAX, robots, static assets
- Cookie: `HttpOnly`, `Secure` when SSL, `SameSite=Lax`
- No license UI in free build (as in current cleaned CAPTCHA)
- Rename everything consistently: `rudyq-shield`, `RudyQ_Shield_*`, options `rudyq_shield_settings`
What is prioritize for the next build
Must-have in v2
1. Rename → RudyQ Shield
2. Keep form CAPTCHA
3. Add PoW visitor gate (from zip, cleaned)
4. Login attempt limits
5. XML-RPC disable
6. Security headers toggles
7. REST user-enumeration block