Hack Halt Security 2.x Knowledge Base

Turn these on first

Four settings that account for most of the protection, before you read anything else.

Jump to a section

Operator guide and complete settings map for every major Security 2.x section, module, and control surface.

Quick Start: Turn These On First

Apply this baseline first on new installs, then use the section map below for deeper tuning.

1. Enable MFA for privileged roles Turn on: mfa_enabled , mfa_enforce_roles Recommended: mfa_enabled = on; mfa_enforce_roles = administrator, editor MFA is one of the highest-impact controls against account takeover. Where: Settings & Tools -> Security Controls -> Multifactor policy.
2. Set the core runtime baseline Turn on: mode , log_admin , omit_owner_traffic_logging Recommended: mode = guarded; log_admin = on; omit_owner_traffic_logging = on Guarded mode plus clean telemetry gives protection and useful investigations without high break risk. Where: Settings & Tools -> Security Controls.
3. Turn on portal hardening essentials Turn on: lockdown_enabled , disable_xmlrpc , disable_file_editor , disable_user_enum , disable_rest_user_enum Recommended: all enabled These remove common WordPress attack paths and reduce recon opportunities quickly. Where: Settings & Tools -> Portal settings.
4. Move admin off default URLs Turn on: custom_admin_url_enabled , custom_admin_slug Recommended: custom_admin_url_enabled = on; custom_admin_slug = unique private slug Hiding predictable admin/login routes cuts automated attack pressure. Where: Settings & Tools -> Portal settings.
5. Enable intrusion prevention Turn on: ips_enabled , ips_score_threshold , ips_block_minutes Recommended: ips_enabled = on; keep defaults for threshold and block window at first IPS gives continuous behavior-based blocking against brute-force and abuse spikes. Where: Hack Halt -> Intrusion Protection -> Settings.
6. Enable threat intel feed enforcement (licensed) Turn on: threat_intel_enabled , threat_intel_auto_sync , threat_intel_action Recommended: threat_intel_enabled = on; auto_sync = on; action = block Known bad indicators should be denied early and kept fresh automatically. Where: Hack Halt -> Firewall Policies -> Threat Intel Feeds.
7. Enable honeypot deception + auto-block (premium) Turn on: honeypot_enabled , honeypot_auto_block , honeypot_email_alerts Recommended: all enabled Deception catches hostile probing early and stops repeat offenders faster. Where: Hack Halt -> Live Traffic -> Honeypots.
8. Turn on continuous scan and drift alerts Turn on: scanner_feed_enabled , scanner_daily_scan , fim_enabled , fim_email_alerts Recommended: all enabled (or run weekly manual scans on free tier) Vulnerability and file-drift coverage catches regressions and compromise signals quickly. Where: Hack Halt -> Vulnerability Scanner -> Policy and Hack Halt -> File Integrity -> Monitoring Policy.

Safety note: Only enable private-portal IP restriction after you have confirmed stable office or VPN static IP ranges in your allowlist. custom_admin_ip_restrict_enabled.

Locked Out? Quick Recovery

If a hardening setting blocks you from wp-admin, use this temporary safety switch to get back in and fix settings.

Temporary wp-config.php line: define('HH_DISABLE_PROTECTION', true);

1. Open your site's wp-config.php file.
2. Add the line below above the "That's all, stop editing!" line.
3. Save the file, then open wp-admin again. Security blocking is temporarily paused.
4. Fix the setting that locked you out (usually private admin URL or IP restriction).
5. Remove the line when done so full protection turns back on.

Important: This does not uninstall anything. It only gives you a safe way back into admin while you correct settings.

Knowledge Map

Jump to each module section and review the settings tied to it.

• Quick Start: Turn These On First 8 baseline actions
• Locked Out? Quick Recovery Emergency access guide
• Dashboard 1 setting groups
• Live Traffic (IP Reports) 1 setting groups
• Firewall Policies 2 setting groups
• Intrusion Protection 2 setting groups
• Vulnerability Scanner 1 setting groups
• CSP 2 setting groups
• File Integrity 1 setting groups
• Settings & Tools 3 setting groups
• Setup Wizard 1 setting groups

Dashboard

Menu path: Hack Halt -> Dashboard

Executive security posture, attack pressure, recommendations, and trend visibility.

• Security score and posture cards.
• Traffic, blocked ratio, and response KPI tiles.
• Global traffic map and correlated threat signals.
• Recommendations based on scanner, integrity, and runtime telemetry.

Core Engine Controls

Option store: hackhalt_settings

Live Traffic (IP Reports)

Menu path: Hack Halt -> Live Traffic

Real-time request intelligence and response workflow for active incidents.

• Overview runtime and trend widgets.
• Live request stream with filters and quick actions.
• Incident command chains for repeated hostile activity.
• Honeypot telemetry and deception controls (premium gate aware).

Honeypot Deception

Option store: hackhalt_settings

Firewall Policies

Menu path: Hack Halt -> Firewall Policies

IP lists, country controls, and premium threat-intelligence policy engine.

• Manual blocklist and allowlist operations.
• Frontend and admin geo access modes with country token selectors.
• Interactive risk map for bulk geo policy edits.
• Threat-intel feed selection, sync cadence, and verification tools.

Geo Country Policy

Option store: hackhalt_settings

Threat Intelligence Feeds

Option store: hackhalt_settings

Intrusion Protection

Menu path: Hack Halt -> Intrusion Protection

Behavioral scoring, signature controls, and adaptive temporary block enforcement.

• Dashboard tab for IPS event flow and pressure.
• Signatures tab for per-rule enable/observe/score tuning.
• Settings tab for global thresholds and lock windows.
• Operational event history with reason labels and action outcomes.

Intrusion Protection Engine

Option store: hackhalt_settings

Intrusion Signature Tuning

Option store: hackhalt_settings

Vulnerability Scanner

Menu path: Hack Halt -> Vulnerability Scanner

Definition-driven scans, server-side vulnerability matching, and remediation workflow.

• Overview and live engine visibility.
• Policy tab for schedule, dataset matching, and definition selection.
• Findings tab with severity and remediation paths.
• History tab for previous run results and cleanup controls.

Vulnerability Scanner Policy

Option store: hackhalt_settings

CSP

Menu path: Hack Halt -> CSP

Content Security Policy builder with learning mode, quick discovery scan, and violation logs.

• Module enable and mode selection (learning or enforced).
• Header hardening options including HSTS and Referrer-Policy.
• Directive source lists with per-directive tuning.
• Quick scan/apply loop and live violation triage queue.

CSP Module Core Settings

Option store: hackhalt_csp_settings

CSP Directives

Option store: hackhalt_csp_settings

File Integrity

Menu path: Hack Halt -> File Integrity

Baseline lifecycle controls, drift alerts, and suspicious file signal workflow.

• Policy controls for scanning, alerting, and upgrade suppression.
• Trusted uploads plugin-path suppression tuning.
• Manual run scan and rebuild baseline controls.
• Alert review tables and suppression event history.

File Integrity Monitoring Policy

Option store: hackhalt_settings

Settings & Tools

Menu path: Hack Halt -> Settings & Tools

Cross-module control plane with portal hardening, controls, feedback, license, and docs.

• Portal settings tab for lockdown and private admin URL.
• Security controls tab for core runtime, crawler, proxy, and MFA.
• Feedback tab for bug report pipeline and ticket sync settings.
• License and documentation tabs for premium activation and in-app manual.

Portal Hardening And Lockdown

Option store: hackhalt_settings

MFA Policy

Option store: hackhalt_settings

Feedback Settings

Option store: hackhalt_settings

Setup Wizard

Menu path: Hack Halt -> Setup Wizard (direct route)

Guided onboarding flow that writes module policies in a safe operational order.

• MFA policy and enrollment kickoff.
• Portal hardening and optional IP guard safety gates.
• Geo policy starter configuration.
• Scanner, File Integrity, and CSP first-run setup actions.

Setup Wizard Payload Keys

Option store: hh_setup (wizard request payload)

Where to go next