Hide the Admin Bar for Subscribers
Hides the toolbar on the front of the site for anyone who cannot edit posts, such as subscribers and shop customers. Authors, editors and administrators keep it.
Snippet Library
3,040 free snippets from the WPIDE team and the community. Copy the code, or add any snippet to your site in one click with WPIDE.
Hides the toolbar on the front of the site for anyone who cannot edit posts, such as subscribers and shop customers. Authors, editors and administrators keep it.
Stops visitors from discovering usernames through ?author=N URLs, the public REST API users endpoint, the users sitemap and oEmbed data.
Adds a Dashboard widget with your own message, such as instructions for clients or contact details for support.
Turns off the XML-RPC interface (xmlrpc.php), a common target for brute-force and pingback abuse. Use it when no app or service needs XML-RPC.
Turns off the built-in Theme File Editor and Plugin File Editor screens, so a hijacked admin account cannot inject code through them.
Shows a colored LOCAL, DEVELOPMENT, STAGING or PRODUCTION badge in the admin bar for administrators, based on the WP_ENVIRONMENT_TYPE setting.
Shows the same error for a wrong username and a wrong password, so the login form does not reveal which usernames exist.
Removes selected menu entries (Tools and Comments by default) for every user who is not an administrator, to keep the admin menu focused.
Stops the "WordPress x.y is available" banner from showing to users who cannot update WordPress, so editors and authors are not distracted by it.
Hides the Screen Options tab for everyone except administrators, so other users cannot rearrange or hide admin panels.
Removes the generator meta tag and the version from feeds, so the exact WordPress version is not advertised in your page source.
Temporarily blocks an IP address after 5 failed logins within 15 minutes. A lightweight brute-force guard with no settings screen.
Removes the ability to install or upload new plugins and themes for every user, while still allowing updates of what is already installed.
Strips ?ver= from front-end CSS and JavaScript URLs when it equals the WordPress version, hiding it from the page source. Plugin and theme versions are left alone.
Only administrators may save raw HTML such as scripts and iframes in posts. Editors get the same safe HTML filtering as authors.
Adds common HTTP security headers to front-end responses: nosniff, same-origin framing, a strict referrer policy and a restrictive permissions policy.
Adds an "Add to calendar" link to single events that downloads an .ics file for Apple Calendar, Outlook and Google Calendar.
Adds an "Add to queue" link under drafts in the Posts list that schedules the post into the next free publishing slot, such as weekdays at 9:00, without picking dates by hand.
Shows a short line above each post or page listing the other languages it has been translated into, with links, so visitors who arrive in the wrong language can switch straight away.
Adds a link under the Add to Cart button that opens an email to your shop with the product name and link already filled in, an easy way to capture pre-sale questions.
Lets customers browse products from chosen categories online but removes the Add to Cart button and shows an "available in store only" message instead.
Adds a "Back to Shoes" style link above each product page that returns the shopper to the product's main category.
Labels products that have sold at least a set number of units with a "Bestseller" badge in shop listings and on the product page.
Adds a My Account tab listing every product the customer has bought before, each with an add-to-cart button, ideal for consumables and repeat orders.