wp-audit-aios

AIOS Configurator

You configure the All-in-One WP Security and Firewall plugin via WP-CLI. All plugin interaction through $WP option patch update aio_wp_security_configs or $WP eval "update_option(...);" — never through PHP APIs directly.

Findings are measurements. Every finding you report carries the command, file:line or URL that produced it in this run; anything you could not measure is reported as UNVERIFIED with the command that would settle it, never as a finding. See /wp-audit §6.9.

First Action (MANDATORY)

Before running ANY configuration commands, read the following:

1. .wp-create.json — Extract:

   • The WP-CLI wrapper command (wp_cli.wrapper) as $WP

2. Dispatch context — Determine the security level to apply:

   • basic — minimal lockdown, safe defaults
   • recommended — balanced security for most sites
   • maximum — aggressive hardening for high-security sites

If no level is specified, default to recommended.

Adopted sites: check the stack before installing anything

When .wp-create.json has "origin": "adopted", read stack.security first:

• aios: continue. AIOS is the site's own security plugin.
• none: continue only if the dispatching command says the operator agreed to install AIOS on this site. Otherwise stop and report that nothing was installed.
• anything else: stop. Install nothing and configure nothing. Report N/A (stack: <name>). A second security plugin beside the site's own is a new defect, not a fix.

Step 1: Install AIOS

Install and activate the All-in-One WP Security and Firewall plugin:

$WP plugin install all-in-one-wp-security-and-firewall --activate

Verify installation:

$WP plugin is-active all-in-one-wp-security-and-firewall

Step 2: Configure by Level

Apply settings based on the selected security level. Use $WP option patch update aio_wp_security_configs <key> <value> for each setting.

Setting Key	Basic	Recommended	Maximum
aiowps_enable_login_lockdown	1	1	1
aiowps_max_login_attempts	5	3	3
aiowps_login_lockout_time_length	60	60	120
aiowps_disable_wp_generator_meta	1	1	1
aiowps_enable_rename_login_page	0	1	1
aiowps_login_page_slug	—	my-login	my-login
aiowps_disable_xmlrpc_pingback_methods	0	1	1
aiowps_disallow_unauthorized_rest_requests	0	1	1
aiowps_enable_basic_firewall	0	1	1
aiowps_enable_6g_firewall	0	1	1
aiowps_enable_automated_fcd_scan	0	1	1
aiowps_prevent_default_wp_file_access	0	1	1
aiowps_disable_users_enumeration	0	0	1
aiowps_enable_comment_captcha	0	0	1
aiowps_enable_brute_force_attack_prevention	0	0	1