Alert When an Administrator Password Reset Is Requested
Emails the site admin whenever someone requests a password reset for an administrator account, an early warning sign of an attempt to take over the site.
Snippet Library
WordPress code snippets, ready to use
3,040 free snippets from the WPIDE team and the community. Copy the code, or add any snippet to your site in one click with WPIDE.
Block Login Attempts From Scripts and Command-Line Tools
Refuses login, password reset and registration requests sent by tools such as curl, wget, python-requests or empty user agents, which real browsers never use and brute-force scripts often do.
Block Malicious Request Patterns
A tiny firewall that returns 403 Forbidden for URLs containing typical attack strings, such as directory traversal, SQL injection and PHP stream wrappers.
Block Spam Searches
Answers search requests that contain links, markup, very long strings or words you block with a 404, stopping bots from filling search pages with spam.
Block TRACE, TRACK and Other Unusual HTTP Methods
Answers requests that use HTTP methods WordPress never needs (such as TRACE, TRACK, CONNECT or DEBUG) with a 405 error before any page is built.
Bot Trap Link That Blocks Misbehaving Crawlers
Adds an invisible link that real visitors never see and well-behaved search engines are told to skip; any client that requests it anyway is blocked from the site for 24 hours.
Cache Public REST API Responses for Visitors
Stores the responses of public GET requests to the REST API (such as post lists used by headless front ends and block widgets) for a few minutes for logged-out visitors, and clears the cache when content changes.
Category and Term Names in REST API Responses
Adds a "term_names" field to REST API responses for posts and custom post types, so apps get category and tag names without extra requests.
Disable the Heartbeat API Except in the Post Editor
Keeps the Heartbeat API (autosave and post locking) in the editor but turns it off on every other admin and front-end page to save server requests.
Erase Custom Profile Fields on Erasure Requests
Deletes the custom user fields you list when you run a personal data erasure request under Tools > Erase Personal Data, so they are not left behind.
Fast 404 for Missing Images, Scripts and Styles
Answers requests for missing images, CSS, JavaScript and font files with a tiny 404 instead of loading a full theme page, saving server time.
Filter REST API Results by Allowed Custom Fields
Lets REST API requests filter posts by custom fields you allow, e.g. /wp-json/wp/v2/posts?meta_key=location&meta_value=paris, for apps and headless front ends.
Find What Is Calling admin-ajax.php
Counts admin-ajax.php requests per action (and whether they come from the front end or the dashboard) for the current day and the previous six, and shows the busiest ones under Tools > AJAX Usage.
Highlight the Customer's Order Note in Admin Emails
Shows the note the customer wrote at checkout in a highlighted box at the top of the admin "New order" email, so special requests are not missed.
Honeypot Trap on the Lost Password Form
Adds a hidden field to the lost password form that only bots fill in and silently ignores those requests, so bots cannot flood your users with reset emails.
Include Custom Comment Fields in Privacy Exports and Erasures
Adds extra comment fields stored as comment meta (such as a phone number or rating) to personal data exports, and removes them during erasure requests.
Inline Small Block Stylesheets Instead of Loading Files
Lets WordPress print more of the small per-block stylesheets directly in the page instead of as separate files, which saves several network requests on pages with many different blocks.
Keep Subscribers Out of wp-admin
Redirects users who cannot edit posts (subscribers, customers) to the homepage when they try to open the admin area. AJAX and admin-post requests keep working.
Limit Password Reset Requests
Allows only a few password reset requests per hour from the same IP address, which stops reset-email flooding.
Load Contact Form 7 Assets Only Where a Form Is Used
Keeps Contact Form 7 scripts and styles off every page except those that contain a form, removing two requests from most pages.
Log Slow Outgoing HTTP Requests
Times every request your site makes to other servers (update checks, APIs, license servers) and records the ones slower than a second under Tools > Slow HTTP Calls, so you can find what is holding up page loads.
One Fluent Forms Submission per Email per Day
Stops the same email address from submitting a Fluent Forms form more than once in 24 hours, useful for giveaways, trials and quote requests.
One WPForms Submission per Email per Day
Stops the same email address from submitting a WPForms form more than once in 24 hours, useful for giveaways and quote requests, even in WPForms Lite.
Pending Privacy Requests Badge in the Admin Menu
Shows a count bubble next to Tools and the Export and Erase Personal Data menu items when confirmed privacy requests are waiting for you to process them.