Block User Enumeration
Stops visitors from discovering usernames through ?author=N URLs, the public REST API users endpoint, the users sitemap and oEmbed data.
WPIDE Team 6 installs
Snippet Library
WordPress code snippets, ready to use
3,040 free snippets from the WPIDE team and the community. Copy the code, or add any snippet to your site in one click with WPIDE.
Disable XML-RPC
Turns off the XML-RPC interface (xmlrpc.php), a common target for brute-force and pingback abuse. Use it when no app or service needs XML-RPC.
WPIDE Team 6 installsDisable the Theme and Plugin File Editors
Turns off the built-in Theme File Editor and Plugin File Editor screens, so a hijacked admin account cannot inject code through them.
WPIDE Team 6 installsGeneric Login Error Message
Shows the same error for a wrong username and a wrong password, so the login form does not reveal which usernames exist.
WPIDE Team 6 installsHide the WordPress Version Number
Removes the generator meta tag and the version from feeds, so the exact WordPress version is not advertised in your page source.
WPIDE Team 6 installsLimit Failed Login Attempts
Temporarily blocks an IP address after 5 failed logins within 15 minutes. A lightweight brute-force guard with no settings screen.
WPIDE Team 6 installsPrevent Installing New Plugins and Themes
Removes the ability to install or upload new plugins and themes for every user, while still allowing updates of what is already installed.
WPIDE Team 6 installsRemove the Core Version From Script and Style URLs
Strips ?ver= from front-end CSS and JavaScript URLs when it equals the WordPress version, hiding it from the page source. Plugin and theme versions are left alone.
WPIDE Team 6 installsRestrict Unfiltered HTML to Administrators
Only administrators may save raw HTML such as scripts and iframes in posts. Editors get the same safe HTML filtering as authors.
WPIDE Team 6 installsSend Basic Security Headers
Adds common HTTP security headers to front-end responses: nosniff, same-origin framing, a strict referrer policy and a restrictive permissions policy.
WPIDE Team 6 installs"Log Out Other Devices" Button for Members
Adds a [wpide_logout_others] shortcode with a button that signs the member out of every other browser and device, keeping the current one logged in.
Active Sessions Column With "Log Out Everywhere"
Shows how many devices each user is logged in on, with a link to end all of that user's sessions from the Users screen.
Alert When an Administrator Password Reset Is Requested
Emails the site admin whenever someone requests a password reset for an administrator account, an early warning sign of an attempt to take over the site.
Allow Administrator Logins Only From Trusted IPs
Administrators can only log in from the IP addresses or ranges you list; everyone else logs in as usual.
Allow Only Administrators to Log In
Temporarily blocks logins for everyone except administrators, for example during a migration or a security incident.
Allow Only Images and PDFs for Non-Administrators
Limits the file types authors, editors and other non-admin users can upload to common images and PDF documents.
Allow Only Minor Core Auto-Updates
Keeps automatic security and maintenance releases of WordPress (like 6.8.1 to 6.8.2) but stops automatic major upgrades.
Allow Only One Active Session per User
Logs a user out of every other browser and device as soon as they log in somewhere new, which stops account sharing.
Allow Only Safe File Types to Be Uploaded
Limits uploads to common images, documents, audio and video, and rejects files with a hidden second extension such as photo.php.jpg.
Allow Some Roles to Log In Only During Office Hours
Lets users in chosen roles, such as shop managers or support staff, log in only on working days between set hours in the site's time zone.
Allow Your Functions in Bricks {echo} Tags
Adds the PHP functions you trust to Bricks' allow list for {echo:function_name} dynamic data tags, which Bricks requires before it runs them.
Allow Your Site to Be Embedded Only on Partner Domains
Replaces the usual same-site framing rule with a Content-Security-Policy frame-ancestors list, so your pages can be shown in iframes on the partner sites you name and nowhere else.
Application Passwords for Administrators Only
Keeps Application Passwords available for administrators (for integrations and apps) but removes them for every other user.
Automatic Updates for the Plugins You Trust Most
Turns on automatic background updates for the plugins you list (for example your security and backup plugins), so security fixes for them are installed within hours without waiting for you.