Generic Login Error Message
Shows the same error for a wrong username and a wrong password, so the login form does not reveal which usernames exist.
WPIDE Team 6 installs
Snippet Library
WordPress code snippets, ready to use
3,040 free snippets from the WPIDE team and the community. Copy the code, or add any snippet to your site in one click with WPIDE.
Accept Application Passwords Only From Trusted IP Addresses
Rejects REST API and XML-RPC logins made with application passwords unless they come from the IP addresses or networks you list, such as your office, CI server or integration partner.
Alert When an Administrator Password Reset Is Requested
Emails the site admin whenever someone requests a password reset for an administrator account, an early warning sign of an attempt to take over the site.
Alert the Site Owner When an Administrator's Email or Password Changes
Emails the site's admin address whenever any administrator account changes its email address or password, a key warning sign of an account takeover.
Allow Application Passwords on Local Sites Without HTTPS
Turns on Application Passwords for local and development copies of the site that run on plain http, so you can test REST API integrations and apps locally the same way as in production.
Application Passwords for Administrators Only
Keeps Application Passwords available for administrators (for integrations and apps) but removes them for every other user.
Ask for the Current Password Before Changing Email or Password
Adds a "Current password" field to the profile screen and refuses changes to your own email address or password unless it is correct, so someone using an unattended logged-in browser cannot take over the account.
Ask for the Password Again Before Sensitive Admin Screens
Requires administrators to log in again before opening plugin, theme, user and update screens when their login is older than 30 minutes, so a hijacked session cannot quietly install code or add users.
Autofill Hints for Contact Form 7 Fields
Adds the right autocomplete attributes to Contact Form 7 name, email, phone and company fields, so browsers and password managers can fill them in one tap.
Block Common and Guessable Passwords
Rejects the most common passwords, and passwords containing the username or site name, when users set or reset their password.
Block Login Attempts From Scripts and Command-Line Tools
Refuses login, password reset and registration requests sent by tools such as curl, wget, python-requests or empty user agents, which real browsers never use and brute-force scripts often do.
Block Password Resets for Administrators
Disables the "Lost your password?" flow for administrator accounts, which closes off reset-email based takeovers of the most powerful accounts.
Block Passwords Found in Known Data Breaches
Checks new passwords against the Have I Been Pwned database of breached passwords when users change or reset them, and asks for a different one if it appears there.
Copy Every Outgoing Email to an Archive Address
Adds a hidden BCC to every email the site sends, so you keep a copy of password resets, orders and form notifications in one mailbox.
Custom Message on Password-Protected Posts
Replaces the standard "This content is password protected" sentence with your own message, for example explaining how to get the password.
Custom Stop Words for Site Search
Ignores filler words such as "can", "my" or "need" in multi-word searches, so "how can I reset my password" finds posts about resetting passwords.
Custom Welcome Email for New Users
Rewrites the email new users receive with their login details, using your own subject and greeting while keeping the secure link to set a password.
Disable Application Passwords
Removes the Application Passwords feature, which lets external apps authenticate to the REST API. Disable it if you do not use it.
Disable Password Resets for Everyone
Turns off the "Lost your password?" feature for all users, for sites where accounts are managed only by an administrator.
Disable XML-RPC Multicall
Removes the XML-RPC system.multicall method, which attackers use to try hundreds of passwords in a single request, while XML-RPC keeps working for apps and Jetpack.
Email Alerts When Application Passwords Are Created
Emails the user and the site administrator whenever a new application password is created for an account, since these passwords give API access that bypasses the normal login.
Emailed Login Code for Staff Accounts
Adds a second step for administrators and editors: after the correct password, WordPress emails a 6-digit code that must be entered to finish logging in.
Expire Passwords After 90 Days
Makes users in chosen roles reset their password once it is older than 90 days; at login they are told it has expired and pointed to the password reset form.
Forget Post Passwords When the Browser Closes
Makes the cookie that remembers a protected post's password last only until the browser is closed, instead of the default 10 days, which matters on shared and public computers.