Pro module3 also in Free8 abilities

Security plugins ability reference

Reference for the GoBuildWP Pro 1.12.4 and Free 1.18.6 source. Installed schemas and policy remain authoritative.

This Security plugins ability reference covers provider-specific status, findings and lockouts, reviewed hardening, IP blocks and scan starts. Supported configuration and block changes have their own recovery contracts; starting a scan is a separate side effect and cannot be undone as configuration. These controls reduce particular risks and do not establish a security audit or freedom from lockout.

By GoBuildWPContent updated 13 October 2026How we check claims

Read-only, write and destructive groups describe the source annotations. They do not establish a minimum safety profile, human approval or undo support. Those controls are separate: check the installed ability, the connected user and the active site policy before calling it. A read can still return sensitive data. These pages are not evidence that every operation passed an end-to-end runtime test.

What Security plugins needs before these load

3 of the 8 also ship in GoBuildWP Free 1.18.6 under the same names, marked “Also in GoBuildWP Free” below. They need no GoBuildWP Pro licence, but each retains its own dependency, feature and permission checks. Where Free's copy does less, its own description follows Pro's. When Pro's richer copy passes its gates, it registers first and answers.

Wordfence or Solid Security (the better-wp-security plugin, branded Kadence Security from 10.0) must be active. Pro loads the kit when the wordfence or ITSEC_Core class, or the WORDFENCE_VERSION constant, is present, and each call reports which provider answered; the kit was verified against Wordfence 9.0.1 and Kadence Security Basic 10.0.4. Every call checks that GoBuildWP is switched on and that the user has manage_options, and the destructive writes need confirm=true. Wordfence will not scan without its own API key, and Solid's cloud scan refuses a site that is not publicly reachable. The three reads mask the same way without a licence; planning and applying hardening, blocks, unblocks and scans are Pro's.

Security plugins editions: free

Addresses it will not block, and settings it never offers

wppilot/security-block-ip refuses any range covering the address this request came from, including forwarding headers and each vendor's own detection (security_block_current_request), and this server's own addresses (security_block_server). It also refuses private, loopback, link-local, carrier-NAT, multicast and reserved ranges, anything wider than /16 for IPv4 or /32 for IPv6 (security_block_too_broad), and an address the vendor already blocks (security_already_blocked).

The hardening plan never proposes disabling application passwords, disabling the REST API or XML-RPC for signed-in users, moving the login URL or country blocking, the settings most likely to lock out the connected account. Two-factor for administrators is turned on through Wordfence Login Security only when the connected administrator has enrolled or include_current_user is true.

How an apply is checked and undone

wppilot/security-apply-settings recomputes the plan and refuses with security_plan_changed when its plan_id no longer matches, so what is written is exactly the plan that was reviewed. One apply runs at a time (security_busy). Each setting is read back, and loopback checks before and after cover the home page, the REST index and the MCP routes signed in with a temporary application password deleted before the call returns. A check that passed before and fails after puts every setting back in the same call.

Undo restores a setting only while it still holds the value the kit wrote; one changed since is named and left alone. Application passwords are never switched off again by an undo.

Why IPs and usernames come back masked

Results give IPs as their /24 (IPv4) or /48 (IPv6) network, usernames as a user_id or a first character plus four asterisks, strip email addresses from vendor text, and never include licence or API keys. The full address stays in the ledger, which needs it to undo a block.

Representative call sequence

This sequence describes the documented calls and checks to perform. It is not a recorded result from an installed WordPress site. Inspect returned errors and partial results, then verify the saved values and affected output before proceeding.

A client's login page is being hammered by one network, and they want it blocked for a day and the login settings tightened.

01 wppilot/security-lockouts Lists current lockouts with the masked network, reason and expiry, confirming which range is behind the attempts.
02 wppilot/security-block-ip With confirm=true and a reason, blocks the range in Wordfence for 24 hours after the guardrails pass.
03 wppilot/security-harden-plan Returns proposed login changes with current and proposed values, warnings and a plan_id, and changes nothing.
04 wppilot/security-apply-settings Writes that plan once the person agrees, verifies each setting and records one undoable change.

Questions about Security plugins

Could an agent lock me out of my own site with this?

It is designed to avoid that, not proven to prevent it. The block call refuses the address the request came from and the server's own addresses, and the hardening plan leaves out the settings known to lock out the connected account. A setting can still lock out a different address, user or client, for example a person signing in from another network. Blocks, and applied settings that still hold the value the kit wrote, can be undone with wppilot/rollback-change, which needs a working connection; keep wp-admin or hosting access to the security plugin as a fallback.

Why does security-run-scan fail on Wordfence?

Wordfence refuses to scan without a Wordfence-issued key, which comes from finishing its onboarding. The call reports that as an error naming the fix instead of starting a scan that cannot run.

Security plugins reads

Ability	What it does
`wppilot/security-harden-plan`Plan Security Hardening	Plans hardening of the site's security plugin (Wordfence or Solid Security) without changing anything. Returns changes (each: setting, label, vendor_setting, current, proposed, reason, and a warning when the person should know a side effect), not_changed (settings left alone and why: already set, or a guardrail), refused (explicit settings that are not allowed, and why), report (what the kit only reports, such as Wordfence extended protection, premium features, a missing scan key, or Solid two-factor), never_offered (what the kit never changes) and plan_id. Without settings it plans the recommended profile: firewall on, brute-force lockouts tightened, scheduled scans, and for Wordfence application passwords kept on and two-factor required for administrators; for Solid, IP detection set to the connecting address only when this request came through no proxy. With settings (setting id => value) it plans exactly those. It never offers disabling application passwords, the REST API or XML-RPC for signed-in users, a hidden login URL, country blocking, anything that blocks this request's address, or requiring two-factor of the connected administrator who has not enrolled (unless include_current_user is true). provider is required when both plugins are active.
`wppilot/security-lockouts`Security LockoutsAlso in GoBuildWP Free	Who the security plugin is blocking, newest first: login lockouts, IP blocks and bans, and rate limits, each with provider, kind, reason, when it started, when it expires (null when permanent) and whether it is still active. IPs are given only as their network (/24 for IPv4, /48 for IPv6). A username is given as user_id when that account exists on this site and otherwise only masked (first character and asterisks); email addresses are never returned. Solid Security keeps lifted lockouts, so recent ones are included unless include_expired is false; Wordfence deletes blocks when they expire, so it lists current ones only. limit defaults to 50, max 200. Read-only: it does not lift or add a block.
`wppilot/security-plugin-status`Security Plugin StatusAlso in GoBuildWP Free	What the site's security plugin (Wordfence and/or Solid Security, formerly iThemes Security) reports about itself, one entry per active provider, each naming the provider that answered: version; whether its firewall is on and in which mode (Wordfence: enabled, learning-mode or disabled, with basic or extended protection); whether scans are scheduled, the next run, when the last scan finished, its result (ok/clean, warn, failed, never_run) and open findings by severity; brute-force/login protection, lockout thresholds and two-factor; active lockouts; and whether the vendor's premium tier is installed. Read-only. Never returns licence keys, API keys or secrets. Use wppilot/security-scan-findings for the findings themselves and wppilot/security-lockouts for who is blocked.
`wppilot/security-scan-findings`Security Scan FindingsAlso in GoBuildWP Free	Open issues from the security plugin's latest scan (Wordfence scan issues; Solid Security site-scanner results), most severe first: provider, severity (critical, high, medium, low, info), type, a short description, the affected file path relative to the WordPress root or the plugin/theme slug, and when it was first seen. Includes counts by severity across all open issues, even when the list is cut by limit. Issues the owner ignored or muted are left out. Filter by severity (e.g. ["critical","high"]); limit defaults to 50, max 200. Read-only: it does not start a scan or fix anything, and it is only as current as the last scan (see last_scan_at in sources).

Security plugins writes

Ability What it does

wppilot/security-run-scanRun Security Scan Starts the security plugin's own scan. Wordfence scans in the background (started true; read results later with wppilot/security-scan-findings) and refuses without a Wordfence key, which this call reports as an error naming the fix (finish Wordfence's onboarding; a free key is enough); if a scan is already running it says so. Solid Security scans from its cloud and waits for the answer (status clean, warn or error); its cloud refuses sites it cannot reach publicly. Changes no setting.

Ability	What it does
`wppilot/security-run-scan`Run Security Scan	Starts the security plugin's own scan. Wordfence scans in the background (started true; read results later with wppilot/security-scan-findings) and refuses without a Wordfence key, which this call reports as an error naming the fix (finish Wordfence's onboarding; a free key is enough); if a scan is already running it says so. Solid Security scans from its cloud and waits for the answer (status clean, warn or error); its cloud refuses sites it cannot reach publicly. Changes no setting.

Destructive Security plugins calls

Ability	What it does
`wppilot/security-apply-settings`Apply Security Settings	Applies a hardening plan to the security plugin: the same provider, settings and include_current_user as wppilot/security-harden-plan, which it recomputes (it never takes the plan from the caller) and refuses when plan_id no longer matches or anything is refused. Each setting is written through the vendor's own save path and read back (applied[].verified). Before and after, it checks over loopback HTTP that the home page and REST index answer, and that the REST API and every MCP endpoint accept an application-password sign-in, using a temporary application password it creates and deletes within the call. If a check that passed before fails after, or a write fails, it attempts to restore the written settings and reports rolled_back or rollback_failed with the reason. Inspect that outcome immediately. On success, change_id identifies the supported captured settings for wppilot/rollback-change; verify the recovery report and external effects separately. Destructive: needs confirm=true.
`wppilot/security-block-ip`Block IP	Blocks one IP address or CIDR range in the security plugin, through its own block list: Wordfence (an IP block, or a pattern block for a range, lasting duration_hours, default 24, 0 = permanent) or Solid Security (a ban, always permanent: omit duration_hours). Refused: the address this request comes from, this server's own addresses, private, loopback, link-local and reserved ranges, ranges wider than /16 (IPv4) or /32 (IPv6), and an address the plugin already blocks. reason is required and shown in the plugin. The result names the target only by its network (/24 or /48). change_id undoes it with wppilot/rollback-change. Destructive: needs confirm=true.
`wppilot/security-unblock-ip`Unblock IP	Lifts the security plugin's blocks on exactly one IP address or CIDR range: in Wordfence every IP block and login lockout on that address (or the pattern block on exactly that range); in Solid Security its ban on exactly that host. It does not lift a wider range or country block that also covers the address. outcome not_blocked when there was nothing to lift. change_id undoes it (the blocks come back with the time they had left) with wppilot/rollback-change. Destructive: needs confirm=true.