Disable XML-RPC
Turns off the XML-RPC interface (xmlrpc.php), a common target for brute-force and pingback abuse. Use it when no app or service needs XML-RPC.
WPIDE Team 6 installs
Snippet Library
WordPress code snippets, ready to use
3,040 free snippets from the WPIDE team and the community. Copy the code, or add any snippet to your site in one click with WPIDE.
ACF Google Maps API Key From wp-config.php
Gives Advanced Custom Fields' Google Map field your API key from a constant in wp-config.php, so the key never sits in the database or theme files.
Alert When PHP Files Appear in the Uploads Folder
Scans the uploads folder once a day for PHP files, which never belong there and usually mean a backdoor, and emails the administrator and shows a dashboard warning when new ones show up.
Alert When wp-config.php, .htaccess or Root Files Change
Checks your site's root folder once a day and emails the administrator when wp-config.php, .htaccess, .user.ini or php.ini change, or when new PHP files appear next to WordPress's own files.
Allow Only Safe File Types to Be Uploaded
Limits uploads to common images, documents, audio and video, and rejects files with a hidden second extension such as photo.php.jpg.
Allow Your Functions in Bricks {echo} Tags
Adds the PHP functions you trust to Bricks' allow list for {echo:function_name} dynamic data tags, which Bricks requires before it runs them.
Block Comments Posted Without Visiting Your Site
Rejects comment submissions that do not come from a page on your own site, which stops bots that post directly to wp-comments-post.php.
Block Malicious Request Patterns
A tiny firewall that returns 403 Forbidden for URLs containing typical attack strings, such as directory traversal, SQL injection and PHP stream wrappers.
Block PHP Execution in the Uploads Folder (Apache)
Adds Tools > Uploads Protection with a button that writes .htaccess rules to your uploads folder so PHP files there can never be run, even if one slips through an upload.
Change the EDD Downloads URL Base
Replaces /downloads/ in your product URLs with a word you choose, such as /plugins/ or /templates/, without defining constants in wp-config.php.
Daily Email Summary of New PHP Errors
Reads new lines in debug.log once a day and emails a short summary of fatal errors, warnings and notices with how often each occurred, so problems do not go unnoticed.
Daily Plugin and Theme File Change Monitor
Fingerprints every PHP file in your plugins and themes once a day and emails the administrator a list of files that were added, changed or removed outside of normal updates.
Deliver Site Emails With SparkPost
Delivers all WordPress emails through SparkPost's Transmissions API instead of PHP mail or SMTP, for dependable delivery and SparkPost's event reporting.
Different Single Post Template per Category
Lets a classic theme use single-cat-{slug}.php for posts in a given category, for example a recipe layout for posts filed under Recipes, falling back to the normal template.
Email Delivery Check in Site Health
Adds a test to Tools > Site Health that warns when WordPress sends mail with plain PHP mail() instead of SMTP or an API, and when an email has failed recently.
Find What Is Calling admin-ajax.php
Counts admin-ajax.php requests per action (and whether they come from the front end or the dashboard) for the current day and the previous six, and shows the busiest ones under Tools > AJAX Usage.
Hide PHP Errors From Visitors
Turns off on-screen PHP warnings and errors for everyone except logged-in administrators, so file paths are never shown to the public.
Keep Bots Out of Redirection's 404 Log
Stops the Redirection plugin from logging 404s caused by crawlers and vulnerability scanners (wp-login probes, .env and .php file hunts), so the log shows only real broken links.
Keep Plugin Deprecation Notices Out of debug.log
Stops PHP deprecation notices coming from plugins and themes from filling debug.log, so the real warnings and errors you are looking for stand out while debugging.
LifterLMS: Send Students to Their Dashboard After Login
Sends students who log in through wp-login.php to the LifterLMS student dashboard instead of the WordPress admin profile.
Load the Parent Theme Stylesheet in a Child Theme
Loads the parent theme's style.css before the child theme's own stylesheet, for child themes created without the enqueue code in functions.php.
Log Deprecated and "Doing It Wrong" Notices With Their Source
Writes every deprecated function, argument, hook or "doing it wrong" notice to the PHP error log with the plugin or theme file that caused it, even when WP_DEBUG is off.
Log Failed Emails
Writes a line to the PHP error log whenever wp_mail() fails, with the subject, recipients and error message, to help debug delivery problems.
Log Slow Page Loads
Writes a line to the PHP error log for every request that takes longer than a set number of seconds, with the URL, time, memory and query count.