While going through the current security plugins for WordPress, I came across an interesting project called, "Inspector WordPress" which is not quite there, but may offer some extra protection in the future.

What it does

This plugin monitors each request to your wordpress blog and based on conditions you can define in the options pane it interrupts the attacker’s action and logs it.

How it works

The plugin has a list of security conditions (stored in conditions.txt). These rules define what requests are considered bad. I took interest in the plugin to see if we could use it in the WP hardening project.

Pros

• The Inspector WordPress menu system is quite nice. It provides a logging page on the desktop as well as a configuration page under the options menu.
• Can be an early warning system to alert you that you are under attack

Cons

• There is no CSRF protection, so an attacker may be able to change/delete your rules remotely
• There is also a persistent XSS vulnerability which may be used to compromise your entire blog.

Affected code:
250 $newConditions = $_POST["conditions"];
251 file_put_contents(dirname(__FILE__).”/conditions.txt”, $newConditions);

Summary

The Inspector WordPress features will be included in the upcoming WP hardening project, however, if you do want to use this plugin, I’d wait until the author has addressed the security issues we found in "cons".

In short, I think its a great first step to something bigger and better. As an additional side note, this plugin will wreck havoc with your application-level firewalls (i.e. ModSecurity) if you try to update the ruleset. This will be the challenge any plugin of this nature will face if it allows rule updates over HTTP.