Block User Enumeration
Stops visitors from discovering usernames through ?author=N URLs, the public REST API users endpoint, the users sitemap and oEmbed data.
WPIDE Team 6 installs
Snippet Library
WordPress code snippets, ready to use
3,040 free snippets from the WPIDE team and the community. Copy the code, or add any snippet to your site in one click with WPIDE.
ACF Google Maps API Key From wp-config.php
Gives Advanced Custom Fields' Google Map field your API key from a constant in wp-config.php, so the key never sits in the database or theme files.
Accept Application Passwords Only From Trusted IP Addresses
Rejects REST API and XML-RPC logins made with application passwords unless they come from the IP addresses or networks you list, such as your office, CI server or integration partner.
Add Invoice, Tracking and Delivery Data to Order API Responses
Includes invoice numbers, tracking details, delivery dates and other order fields you list in WooCommerce REST API order responses, for accounting and shipping integrations.
Add Language and Translations to the REST API (WPML)
Adds wpml_language and wpml_translations fields to posts and pages in the REST API, so headless front ends and apps know each item's language and the IDs of its translations.
Add an Attribution Line to Feed Items
Appends "The post ... first appeared on ..." with links to every feed item, which credits you when content is scraped from your feed.
Allow Application Passwords on Local Sites Without HTTPS
Turns on Application Passwords for local and development copies of the site that run on plain http, so you can test REST API integrations and apps locally the same way as in production.
Allow Only Chosen REST API Namespaces for Visitors
Blocks REST API routes for logged-out visitors except the namespaces you list (for example oEmbed, contact forms and the WooCommerce Store API), shrinking the public attack surface without breaking front-end features.
Allow Random Order in REST API Post Lists
Lets REST API clients request posts with orderby=rand, for example to show a few random articles in an app, which WordPress does not allow by default.
Application Passwords for Administrators Only
Keeps Application Passwords available for administrators (for integrations and apps) but removes them for every other user.
Assign a Language to Posts Created by Importers and Code
Gives posts created outside the editor, for example by importers, cron jobs, forms or the REST API, the default Polylang language when they have none, so they do not vanish from language-filtered lists.
Author Name and Avatar in REST API Posts
Adds an author_details field with the author's display name, profile link and avatar URL to every post in the REST API, saving apps a second request or a heavy _embed call.
Cache Any Expensive Result With One Function
Adds a wpide_remember() helper that returns a cached value if there is one, or runs your function, stores the result for a set time and returns it, which makes caching slow queries and API calls a one-liner.
Cache Public REST API Responses for Visitors
Stores the responses of public GET requests to the REST API (such as post lists used by headless front ends and block widgets) for a few minutes for logged-out visitors, and clears the cache when content changes.
Category and Term Names in REST API Responses
Adds a "term_names" field to REST API responses for posts and custom post types, so apps get category and tag names without extra requests.
Clean Up the Page Head
Removes rarely used tags from the page head: RSD, Windows Live Writer manifest, shortlink, adjacent post links and the REST API discovery link.
Deliver Site Emails With SparkPost
Delivers all WordPress emails through SparkPost's Transmissions API instead of PHP mail or SMTP, for dependable delivery and SparkPost's event reporting.
Delivery Day Selector on the Block Checkout
Adds a required "Delivery day" dropdown to the Checkout block listing the next working days, stored on the order with WooCommerce's additional fields API.
Disable Application Passwords
Removes the Application Passwords feature, which lets external apps authenticate to the REST API. Disable it if you do not use it.
Disable the Heartbeat API Except in the Post Editor
Keeps the Heartbeat API (autosave and post locking) in the editor but turns it off on every other admin and front-end page to save server requests.
Email Alerts When Application Passwords Are Created
Emails the user and the site administrator whenever a new application password is created for an account, since these passwords give API access that bypasses the normal login.
Email Delivery Check in Site Health
Adds a test to Tools > Site Health that warns when WordPress sends mail with plain PHP mail() instead of SMTP or an API, and when an email has failed recently.
Enable the Block Editor and REST API for a Plugin's Post Type
Turns on REST API support for post types registered without it, which also switches them to the block editor and makes them available to apps and headless sites.
Example Custom REST API Endpoint
Registers a read-only endpoint at /wp-json/wpide/v1/latest that returns your latest posts in a compact format, as a starting point for your own API routes.