Remove the cPFence security MU plugin

The cPFence security MU plugin supplies XML-RPC restrictions, login limits, WordPress CAPTCHA, idle logout and security headers. It loads automatically in WordPress.

Remove it and keep it disabled

1. In WordPress Management, choose the server and open Settings.
2. Turn these five child policies off: Disable XML-RPC, Limit login attempts, Login CAPTCHA, Idle logout and Security headers. Select Save settings.

Turn off these four security-MU child policies on the intended server; the fifth, Security headers, is farther down. Select the image to view it full size; use your browser’s Back command to return.

Also turn Security headers off, then save. The displayed saved values illustrate the controls, not the required off state. Select the image to view it full size; use your browser’s Back command to return.

3. As root on that server, run:

   cpfence --bulk-remove-mu-plugin

4. Read the result and check site sign-in and response headers.

This command is server-wide

It discovers the cPFence security MU plugin across the server’s WordPress roots. It does not use checked WebUI site rows or the edited site list. Run it only when removal from the whole server is intended.

Policy can recreate the plugin

Keep the five child settings off. Removing the file alone does not change daily policy. For site-specific exceptions, use AutoShield exclusions and the corresponding selected-site controls.

Manage custom MU plugin is a separate action for your uploaded PHP plugin; it does not mean removal of cPFence’s built-in security plugin.