Solid Security MCP for lockouts, host bans, hardening and site scans

Putting Cloudflare in front of a site the Solid Security MCP already hardened

The IP detection setting the hardening plan chooses is right for the site as it is today, and it can turn harmful later. When the plan sees a request with no proxy or CDN header, it sets Solid's detection so the connecting address is taken as the visitor's own. If the site is later moved behind Cloudflare, a load balancer or another proxy, every visitor arrives from the proxy's addresses. Solid then counts everyone's failed logins against those few addresses, and one lockout can block every visitor at once.

So a CDN change and a Solid change belong in the same ticket. Before switching DNS, set Solid's IP detection to manual with the header your proxy sends, in Solid's own settings. Afterwards, security-plugin-status shows the detection method Solid is using, and security-lockouts shows whether new lockouts are spread across real visitor networks or piled on one range that belongs to the proxy.

Reading the outcome of security-apply-settings on Solid

The apply call recomputes the plan rather than trusting one sent back to it, and refuses when plan_id no longer matches. That happens when someone changed a Solid setting between the plan and the approval. Ask for a fresh plan instead of retrying. Once it runs, each setting is saved through ITSEC_Modules and read back, and applied[].verified says whether it stuck.

Three outcomes matter. A clean apply returns one change_id that undoes every setting together with rollback-change. rolled_back means a loopback check that passed before failed afterwards, for example the MCP endpoint stopped accepting an application password sign-in, so every setting was put back at once and the reason is given. rollback_failed is the one to act on immediately: the plan could not restore what it changed, and the settings need checking in Solid's screens straight away.

A weekly Solid Security review on GoBuildWP Free

Three read-only security abilities are part of GoBuildWP Free, which is enough for a routine check. security-plugin-status gives the module states, whether IP detection is configured and when Solid's cloud last scanned. security-scan-findings lists open site scanner results by severity, leaving out anything the owner muted. security-lockouts with include_expired shows the week's lockouts, bans and rate limits, including lifted ones, up to two hundred at a time.

Usernames in that log come back as a user id when the account exists and masked otherwise, which is how to tell an attack on a real editor's account from guesses at names that do not exist. A run of masked attempts is guessing at names that do not exist here, which Solid has been locking out; it is still worth watching for volume and source networks, because a lockout record does not prove the attempts stopped. Repeated lockouts for one real user id is a reason to talk to that person about their password and two-factor. The review runs under the Read Only safety profile, and a Pro licence is needed only when you want the agent to ban, unblock, scan or apply settings. How GoBuildWP secures the MCP connection explains the profiles, and the Wordfence page covers the same abilities against Wordfence.

• "Read only: summarise this week's Solid lockouts by network and by real user id."
• "Plan Solid hardening for this site and tell me which settings you would leave alone and why. Apply nothing."
• "We are moving to Cloudflare next week. What does Solid's IP detection say now, and what will I need to change?"