Accept Application Passwords Only From Trusted IP Addresses
Rejects REST API and XML-RPC logins made with application passwords unless they come from the IP addresses or networks you list, such as your office, CI server or integration partner.
Snippet Library
WordPress code snippets, ready to use
3,040 free snippets from the WPIDE team and the community. Copy the code, or add any snippet to your site in one click with WPIDE.
Allow Application Passwords on Local Sites Without HTTPS
Turns on Application Passwords for local and development copies of the site that run on plain http, so you can test REST API integrations and apps locally the same way as in production.
Application Passwords for Administrators Only
Keeps Application Passwords available for administrators (for integrations and apps) but removes them for every other user.
Ask for the Current Password Before Changing Email or Password
Adds a "Current password" field to the profile screen and refuses changes to your own email address or password unless it is correct, so someone using an unattended logged-in browser cannot take over the account.
Block Common and Guessable Passwords
Rejects the most common passwords, and passwords containing the username or site name, when users set or reset their password.
Block Passwords Found in Known Data Breaches
Checks new passwords against the Have I Been Pwned database of breached passwords when users change or reset them, and asks for a different one if it appears there.
Custom Stop Words for Site Search
Ignores filler words such as "can", "my" or "need" in multi-word searches, so "how can I reset my password" finds posts about resetting passwords.
Disable Application Passwords
Removes the Application Passwords feature, which lets external apps authenticate to the REST API. Disable it if you do not use it.
Disable XML-RPC Multicall
Removes the XML-RPC system.multicall method, which attackers use to try hundreds of passwords in a single request, while XML-RPC keeps working for apps and Jetpack.
Email Alerts When Application Passwords Are Created
Emails the user and the site administrator whenever a new application password is created for an account, since these passwords give API access that bypasses the normal login.
Expire Passwords After 90 Days
Makes users in chosen roles reset their password once it is older than 90 days; at login they are told it has expired and pointed to the password reset form.
Forget Post Passwords When the Browser Closes
Makes the cookie that remembers a protected post's password last only until the browser is closed, instead of the default 10 days, which matters on shared and public computers.
Hide Whether an Account Exists on Password Reset
Shows the same "check your email" screen for unknown usernames and emails on the lost password form, so it cannot be used to find valid accounts.
Limit Guesses on Password-Protected Posts
Allows each visitor at most 10 password attempts on password-protected posts and pages every 15 minutes, which stops bots from brute-forcing the post password.
Limit Password Reset Requests
Allows only a few password reset requests per hour from the same IP address, which stops reset-email flooding.
Noindex Password-Protected Posts and Pages
Adds noindex to posts and pages that need a password, so search engines do not list pages whose content they cannot see.
Prevent Reusing Any of the Last 5 Passwords
Remembers the last five password hashes of each user and refuses a new password that matches one of them, on the profile screen and on password reset.
Remind Administrators to Change Old Passwords
Shows administrators a reminder when they have not changed their password for 180 days.
Require Strong Passwords for Editors and Administrators
Requires at least 12 characters with letters, numbers and a symbol or mixed case for users who can edit other people's content.
Require a Minimum Password Length
Rejects new passwords shorter than 12 characters on the profile screen, the Add New User screen and the password reset form.
Show/Hide Button on Front-End Password Fields
Adds an accessible "Show" button inside password fields on the front of the site (account, checkout and membership forms), so visitors can check what they typed.
Strong Password Tip on the MemberPress Sign-Up Form
Adds a short tip about choosing a strong, unique password just above the MemberPress checkout button.
Write SMTP Conversation to the Debug Log
Records the conversation between WordPress and your SMTP server in the PHP error log while you troubleshoot, with passwords and login tokens blanked out.