Disable XML-RPC
Turns off the XML-RPC interface (xmlrpc.php), a common target for brute-force and pingback abuse. Use it when no app or service needs XML-RPC.
WPIDE Team 6 installs
Snippet Library
WordPress code snippets, ready to use
3,040 free snippets from the WPIDE team and the community. Copy the code, or add any snippet to your site in one click with WPIDE.
Disable the Theme and Plugin File Editors
Turns off the built-in Theme File Editor and Plugin File Editor screens, so a hijacked admin account cannot inject code through them.
WPIDE Team 6 installsAccept Orders Only During Opening Hours
Disables checkout outside your opening hours and shows a notice with the time you open again. Ideal for restaurants and local delivery.
Allow Only Minor Core Auto-Updates
Keeps automatic security and maintenance releases of WordPress (like 6.8.1 to 6.8.2) but stops automatic major upgrades.
Block Password Resets for Administrators
Disables the "Lost your password?" flow for administrator accounts, which closes off reset-email based takeovers of the most powerful accounts.
Block Publishing Until Every Image Has Alt Text
Disables the Publish and Update buttons in the block editor while any image block is missing alternative text, and shows a notice explaining why.
BuddyPress: Turn Off Cover Images
Disables cover image uploads for member profiles and groups, keeping profiles simple and saving storage.
Catalog Mode (Prices Without Purchasing)
Turns the shop into a catalog: products and prices stay visible, but add to cart buttons, the cart and checkout are disabled for everyone.
Disable "sizes=auto" on Lazy-Loaded Images
Turns off the automatic sizes="auto" attribute WordPress adds to lazy-loaded images, which some themes and sliders display incorrectly.
Disable Additional CSS
Removes the Additional CSS panel from the Customizer and the custom CSS option in the Site Editor, so styles are only changed in code.
Disable All Automatic Updates
Turns off every background update: WordPress core, plugins, themes and translations. For sites where updates are deployed by hand or through version control.
Disable Application Passwords
Removes the Application Passwords feature, which lets external apps authenticate to the REST API. Disable it if you do not use it.
Disable Author Archives
Redirects author archive pages to the homepage. Good for single-author sites where the author archive duplicates the blog page.
Disable Automatic Paragraphs
Stops WordPress from wrapping text in paragraph tags and adding line breaks in classic content and excerpts. Block content is not affected.
Disable Automatic Translation Updates
Stops WordPress from installing updated language files on its own, for sites with customized translations.
Disable Big Image Scaling
Stops WordPress from creating a scaled-down "-scaled" copy of images larger than 2560 pixels, so the original file is used as uploaded.
Disable Block Directory Suggestions
Stops the block inserter from suggesting and installing blocks from the WordPress.org block directory.
Disable Categories for Posts
Removes categories from posts: the Categories menu, the editor panel and the column in the posts list.
Disable Comments Completely
Turns comments off everywhere: closes comments and pings, hides existing comments, and removes the Comments menu, admin bar item and comment feed links.
Disable Comments on Specific Post Types
Turns comments and pings off for the post types you choose, such as pages or products, while keeping them on blog posts.
Disable Core Block Patterns
Removes the block patterns that ship with WordPress itself, so the pattern inserter only shows your theme and custom patterns.
Disable Date Archives
Makes yearly, monthly and daily archive pages return a 404, which avoids thin duplicate pages on most sites.
Disable Duotone Filters
Removes the duotone image filter controls from the editor and stops WordPress outputting the default duotone presets.
Disable Marketplace Suggestions
Removes the extension suggestions WooCommerce shows in the admin, such as on the product and order screens.