Add nofollow to External Links in Content
Adds rel="nofollow" to links in posts and pages that point to other websites, while keeping any rel values already set. Links to your own domain are untouched.
Snippet Library
WordPress code snippets, ready to use
3,040 free snippets from the WPIDE team and the community. Copy the code, or add any snippet to your site in one click with WPIDE.
Allow Network Signups Only From Certain Email Domains
Rejects user signups on the network unless the email address belongs to one of your domains, such as a school or company network.
Allow Your Site to Be Embedded Only on Partner Domains
Replaces the usual same-site framing rule with a Content-Security-Policy frame-ancestors list, so your pages can be shown in iframes on the partner sites you name and nowhere else.
Allow the Administrator Role Only for Company Email Addresses
Refuses to give the administrator role to accounts whose email address is not on one of your approved domains, whether set from the profile screen, the Add User screen or a bulk role change.
Assign a Role Based on the Email Domain
Gives people who register with certain email domains a different role automatically, for example staff at your company become Contributors.
Block Checkout for Listed Emails and Phone Numbers
Stops orders from customers on your block list, such as repeat chargeback offenders, matched by email address, email domain or phone number.
Block Disposable Emails in Mailchimp for WP Forms
Refuses newsletter signups from throwaway email domains in Mailchimp for WordPress forms, keeping your audience clean and your Mailchimp bill lower.
Block Email Domains in Contact Form 7
Rejects Contact Form 7 submissions whose email address belongs to a domain on your block list, with a clear message under the email field.
Block Email Domains in Fluent Forms
Shows an error when someone uses an email address from a domain on your block list, such as throwaway inbox services, in a Fluent Forms form.
Block Email Domains in Gravity Forms
Shows an error when someone enters an email address from a domain on your block list, such as throwaway inbox services, in any Gravity Forms email field.
Block Email Domains in WPForms
Shows an error when an email address from a domain on your block list, such as throwaway inbox services, is entered in any WPForms email field.
Change the Sender Name and Address of WordPress Emails
Replaces the default "WordPress <wordpress@yourdomain>" sender with your site name and, optionally, an address of your choice.
Clean Up Email Recipient Lists Before Sending
Removes duplicate, malformed and placeholder addresses (such as example.com or .test domains) from email recipient lists, so one bad address does not make the whole email fail.
Cross-Origin Opener Policy and Related Isolation Headers
Sends Cross-Origin-Opener-Policy, Origin-Agent-Cluster and X-Permitted-Cross-Domain-Policies headers on public pages, which stop other sites you link to or that open yours from reaching into your pages.
Enable HTTP Strict Transport Security (HSTS)
Tells browsers to always use HTTPS for your domain for one year. Only enable it once the whole site, including subdomains you use, works over HTTPS.
Find Insecure http:// Links in Content (WP-CLI)
Adds a "wp find-http-links" command that lists posts containing http:// images, scripts or links, marking which point to your own domain, to clean up mixed content after moving to HTTPS.
Fix Old Subsite URLs After Domain Mapping
Rewrites links and image URLs that still point at a site's old network address (like example.com/shop/) to its mapped domain when content is displayed.
Hourly Limit on Outgoing Emails
Caps how many emails the site can send per hour and stops the rest, which protects your mail account and domain reputation if a form or plugin is abused to send spam.
Keep the From Address on Your Own Domain
When a plugin sends email "from" a visitor's or a free webmail address, switches the From to your own domain and keeps the original address as Reply-To, so emails pass SPF and DMARC checks.
Let Other Sites Read Your Feeds With JavaScript
Sends a CORS header with your RSS and Atom feeds, so web apps, widgets and dashboards on other domains can load them with fetch() instead of hitting a browser error.
Mapped Domain Column in the Network Sites List
Shows each site's public address next to its network address in Network Admin > Sites and flags sites whose Home and Site URLs do not match, a common domain-mapping mistake.
MemberPress: Only Allow Sign-Ups From Certain Email Domains
Rejects MemberPress registrations unless the email address belongs to one of your allowed domains, ideal for company or school memberships.
Never Email Certain Addresses or Domains
Removes addresses and whole domains on your suppression list from every outgoing email, such as bouncing inboxes or people who asked not to be contacted, and skips emails left with no recipient.
Only Allow Registration From Certain Email Domains
Limits sign-ups to email addresses at the domains you list, for example your company or school domain.