Send Basic Security Headers
Adds common HTTP security headers to front-end responses: nosniff, same-origin framing, a strict referrer policy and a restrictive permissions policy.
WPIDE Team 6 installs
Snippet Library
WordPress code snippets, ready to use
3,040 free snippets from the WPIDE team and the community. Copy the code, or add any snippet to your site in one click with WPIDE.
Block Roles From the Elementor Editor
Stops the roles you list from opening the Elementor editor, using Elementor's own role exclusion list, while they keep normal access to the WordPress editor.
Capability Audit for Risky Permissions
Adds Users > Capability Audit, listing every role other than Administrator and every user outside the administrator role that holds powerful permissions such as unfiltered HTML, plugin installation or user management.
Content-Only Editing of Pages for Non-Administrators
Locks the layout of pages in the block editor for everyone except administrators, so editors can change text and images but cannot move, delete or restyle blocks and break the design.
Give a Role Full Control of One Post Type Only
Gives a custom post type its own permissions and lets a chosen role (for example Author) manage it fully, including others' items, without extra rights elsewhere.
Hide Comments in the Admin From Users Who Cannot Moderate
Removes the Comments menu, admin bar bubble and screen for users without moderation rights, such as authors and contributors.
Hide Design Controls From Authors and Contributors
Hides color, typography, spacing and border controls in the block editor for authors and contributors, so they focus on writing while editors keep full design control.
Hide Selected Page Templates From Non-Administrators
Removes chosen templates, such as a landing page or a blank canvas, from the template picker for editors and authors, so only administrators can apply layouts that need care.
Hide Template Editing in the Post Editor
Removes the option to switch to and edit the site template from inside the post and page editor, so content editors cannot change the site layout by accident.
Hide the "Additional CSS Class" Field From Non-Administrators
Removes the Additional CSS class(es) field from the block Advanced panel for non-administrators, keeping authors to the styles you have designed.
Hide the Custom Fields Box From Non-Administrators
Removes the raw "Custom Fields" box from the editor for everyone except administrators, so editors cannot accidentally change values that plugins and the theme depend on.
Hide the Custom HTML Block From Non-Administrators
Removes the Custom HTML block from the inserter for users who cannot post unfiltered HTML, so authors use proper blocks instead of pasting raw markup.
Hide the Plugins Screen From Site Admins
Removes the Plugins menu from subsite dashboards for everyone except super admins and blocks direct visits, even if "Enable administration menus" is on in Network Settings.
Keep Selected Roles Out of Beaver Builder
Sends users without the chosen capability back to the normal page if they try to open Beaver Builder, and hides its admin bar link from them.
Keep Selected Roles Out of the Bricks Builder
Sends users without the chosen capability back to the page when they try to open the Bricks builder and hides its admin bar link, as an extra lock on top of Bricks' builder access settings.
Keep Selected Roles Out of the Divi Visual Builder
Sends users without the capability you choose back to the normal page when they try to open the Divi Visual Builder, and hides the "Enable Visual Builder" admin bar link from them.
Let Editors Manage Redirects in Redirection
Gives editors access to the Redirection plugin's screens so they can add and fix redirects themselves, without making them administrators.
Let Site Admins Edit Their Own Site's Users
Allows site administrators to edit the profiles of users who belong to their site, which multisite normally reserves for super admins.
Limit the Blocks Authors and Contributors Can Use
Gives authors and contributors a short list of everyday blocks (text, headings, lists, images, quotes, embeds) while editors and administrators keep every block.
Lock the List of Super Admins
Blocks anyone from being granted super admin rights unless their username is on your approved list, protecting the network if a super admin account is compromised.
Remove Quick Edit for Non-Administrators
Hides the Quick Edit link and the Edit bulk action for everyone except administrators, so status, dates and slugs are only changed in the full editor.
Security Headers for wp-admin and the Login Page
Sends nosniff, a strict referrer policy, a restrictive permissions policy and a cross-origin opener policy on dashboard and login pages, which front-end header snippets do not cover.
Show Authors Only Their Own Posts in Admin Lists
Users who cannot edit other people's posts, like authors and contributors, see only their own items in the admin lists.
Site Health Check for Security Headers
Adds a Site Health test that loads your homepage and reports which common security headers (HSTS, CSP, nosniff, framing, referrer and permissions policies) are missing.