Disable XML-RPC
Turns off the XML-RPC interface (xmlrpc.php), a common target for brute-force and pingback abuse. Use it when no app or service needs XML-RPC.
WPIDE Team 6 installs
Snippet Library
WordPress code snippets, ready to use
3,040 free snippets from the WPIDE team and the community. Copy the code, or add any snippet to your site in one click with WPIDE.
Limit Failed Login Attempts
Temporarily blocks an IP address after 5 failed logins within 15 minutes. A lightweight brute-force guard with no settings screen.
WPIDE Team 6 installsBan IPs That Try Common Attack Usernames
Blocks an IP address from logging in for a day as soon as it tries a username like "admin" or "test" that does not exist on your site.
Block Login Attempts From Scripts and Command-Line Tools
Refuses login, password reset and registration requests sent by tools such as curl, wget, python-requests or empty user agents, which real browsers never use and brute-force scripts often do.
Daily Email Summary of Failed Logins
Counts failed login attempts during the day (per username and IP address) and emails the administrator a short summary each morning, so you notice brute-force attacks without a flood of alerts.
Disable XML-RPC Multicall
Removes the XML-RPC system.multicall method, which attackers use to try hundreds of passwords in a single request, while XML-RPC keeps working for apps and Jetpack.
Limit Guesses on Password-Protected Posts
Allows each visitor at most 10 password attempts on password-protected posts and pages every 15 minutes, which stops bots from brute-forcing the post password.
Protect wp-login.php With a Secret Key
Hides the login page behind a secret link: wp-login.php returns "Not Found" unless you have opened it with your key once in this browser.
Reject Login Attempts That Don't Come From Your Login Form
Refuses login form submissions that are not sent from a page on your own site, which stops many brute-force bots that post straight to wp-login.php.
Reject Login Attempts for Common Usernames
Refuses login attempts for usernames bots love to try, such as "admin", "administrator" or "root", before WordPress even checks a password.
Slow Down Failed Login Attempts
Waits a second or two before answering a failed login, which makes password-guessing bots far slower without bothering real users.