Block User Enumeration
Stops visitors from discovering usernames through ?author=N URLs, the public REST API users endpoint, the users sitemap and oEmbed data.
Snippet Library
3,040 free snippets from the WPIDE team and the community. Copy the code, or add any snippet to your site in one click with WPIDE.
Stops visitors from discovering usernames through ?author=N URLs, the public REST API users endpoint, the users sitemap and oEmbed data.
Strips ?ver= from front-end CSS and JavaScript URLs when it equals the WordPress version, hiding it from the page source. Plugin and theme versions are left alone.
Adds pages that WordPress does not manage, such as static files or app routes, to All in One SEO's sitemap.
Adds a sitemap of extra URLs, such as static landing pages or sections served outside WordPress, to the built-in sitemap index.
Adds Disallow rules for internal search result URLs to the robots.txt file that WordPress generates.
A tiny firewall that returns 403 Forbidden for URLs containing typical attack strings, such as directory traversal, SQL injection and PHP stream wrappers.
Tells WP Rocket to keep separate cached copies for URLs with the query parameters you list, such as a currency or filter parameter, instead of skipping the cache for them.
Replaces the version number on your theme's and plugins' CSS and JavaScript URLs with the file's last-modified time, so browsers and CDNs cache files for a long time but always fetch a fresh copy right after you change one.
Adds canonical link tags to the blog page, category, tag, author and post type archives, which WordPress only does for single posts and pages by default.
Replaces /downloads/ in your product URLs with a word you choose, such as /plugins/ or /templates/, without defining constants in wp-config.php.
Sets how many URLs each Yoast SEO sitemap page holds. Lower it if large sitemaps time out on your server.
Changes how many links each page of the built-in XML sitemap holds (2,000 by default), for example to split a huge sitemap into smaller files.
Converts uploaded file names to lowercase, removes accents and replaces spaces and symbols with dashes, for tidy and portable URLs.
Turns search off: search URLs return a 404 page, the search form is emptied and the classic Search widget is removed.
Adds a "wp list-urls" command that prints the address of every published post, page, custom post and term archive, ready to build a redirect map before a migration or redesign.
Rewrites links and image URLs that still point at a site's old network address (like example.com/shop/) to its mapped domain when content is displayed.
Turns relative links and image paths such as "/about/" in feed content into full URLs, so they work in feed readers and RSS emails.
Permanently redirects addresses that contain double slashes, such as /blog//my-post/, to the clean version, avoiding duplicate pages from broken links and badly built URLs.
Replaces the ?ver= value on plugin and theme CSS and JavaScript files with a short hash, so scanners cannot read your exact plugin versions from the page source, while caches still refresh whenever a version changes.
Sends visitors who open a saved Elementor template's own address back to the homepage and marks those pages noindex, so loose template URLs never show up in Google.
Sends an X-Robots-Tag header that asks search engines not to index your RSS feeds, so feed URLs do not compete with your real pages.
Adds CSS selectors and stylesheet URLs that WP Rocket's Remove Unused CSS must always keep, such as classes added by JavaScript for menus, sliders and pop-ups, so those elements do not lose their styling.
Serves images from your own server instead of Jetpack's Site Accelerator CDN when their URL contains a pattern you choose, for example SVGs, signed URLs or a specific folder.
Turns post and term titles written in Cyrillic, Greek, Georgian or other non-Latin scripts into readable Latin URL slugs (for example "Привет мир" becomes privet-mir) instead of long percent-encoded addresses.