Block User Enumeration
Stops visitors from discovering usernames through ?author=N URLs, the public REST API users endpoint, the users sitemap and oEmbed data.
WPIDE Team 6 installs
Snippet Library
Security snippets for WordPress
Snippets that harden WordPress: turn off XML-RPC, hide the version number, stop user enumeration, add security headers and block risky uploads. Small, reviewable changes for site owners who want fewer attack points without a heavy security plugin.
Disable XML-RPC
Turns off the XML-RPC interface (xmlrpc.php), a common target for brute-force and pingback abuse. Use it when no app or service needs XML-RPC.
WPIDE Team 6 installsDisable the Theme and Plugin File Editors
Turns off the built-in Theme File Editor and Plugin File Editor screens, so a hijacked admin account cannot inject code through them.
WPIDE Team 6 installsHide the WordPress Version Number
Removes the generator meta tag and the version from feeds, so the exact WordPress version is not advertised in your page source.
WPIDE Team 6 installsLimit Failed Login Attempts
Temporarily blocks an IP address after 5 failed logins within 15 minutes. A lightweight brute-force guard with no settings screen.
WPIDE Team 6 installsPrevent Installing New Plugins and Themes
Removes the ability to install or upload new plugins and themes for every user, while still allowing updates of what is already installed.
WPIDE Team 6 installsRemove the Core Version From Script and Style URLs
Strips ?ver= from front-end CSS and JavaScript URLs when it equals the WordPress version, hiding it from the page source. Plugin and theme versions are left alone.
WPIDE Team 6 installsRestrict Unfiltered HTML to Administrators
Only administrators may save raw HTML such as scripts and iframes in posts. Editors get the same safe HTML filtering as authors.
WPIDE Team 6 installsSend Basic Security Headers
Adds common HTTP security headers to front-end responses: nosniff, same-origin framing, a strict referrer policy and a restrictive permissions policy.
WPIDE Team 6 installs"Log Out Everyone" Button for Emergencies
Adds a button under Tools > Log Out Everyone that ends every login session on the site except your own, useful after a suspected break-in or a staff change.
Accept Application Passwords Only From Trusted IP Addresses
Rejects REST API and XML-RPC logins made with application passwords unless they come from the IP addresses or networks you list, such as your office, CI server or integration partner.
Active Login Sessions Overview
Adds Users > Active Sessions, listing everyone who is currently logged in with their login time, IP address and browser, and lets you end a user's sessions with one click.
Activity Log in Its Own Database Table
Records logins, failed logins, content changes, plugin, theme and user changes and edits to key settings in a dedicated database table, with a searchable, paginated log under Tools > Activity Log and automatic cleanup.
Add a Random Suffix to Uploaded File Names
Appends a short random string to the name of every uploaded file (for example report-k3f9q2.pdf), so private documents cannot be found by guessing their URL.
Alert When PHP Files Appear in the Uploads Folder
Scans the uploads folder once a day for PHP files, which never belong there and usually mean a backdoor, and emails the administrator and shows a dashboard warning when new ones show up.
Alert When wp-config.php, .htaccess or Root Files Change
Checks your site's root folder once a day and emails the administrator when wp-config.php, .htaccess, .user.ini or php.ini change, or when new PHP files appear next to WordPress's own files.
Alert the Site Owner When an Administrator's Email or Password Changes
Emails the site's admin address whenever any administrator account changes its email address or password, a key warning sign of an account takeover.
Allow Administrator Logins Only From Trusted IPs
Administrators can only log in from the IP addresses or ranges you list; everyone else logs in as usual.
Allow Only Chosen REST API Namespaces for Visitors
Blocks REST API routes for logged-out visitors except the namespaces you list (for example oEmbed, contact forms and the WooCommerce Store API), shrinking the public attack surface without breaking front-end features.
Allow Only Safe File Types to Be Uploaded
Limits uploads to common images, documents, audio and video, and rejects files with a hidden second extension such as photo.php.jpg.
Allow XML-RPC Only From Trusted IP Addresses
Keeps XML-RPC available for the services you list (such as Jetpack or a publishing app on your office network) while answering every other XML-RPC request with a 403 error.
Allow Your Site to Be Embedded Only on Partner Domains
Replaces the usual same-site framing rule with a Content-Security-Policy frame-ancestors list, so your pages can be shown in iframes on the partner sites you name and nowhere else.
Allow the Administrator Role Only for Company Email Addresses
Refuses to give the administrator role to accounts whose email address is not on one of your approved domains, whether set from the profile screen, the Add User screen or a bulk role change.
Application Passwords for Administrators Only
Keeps Application Passwords available for administrators (for integrations and apps) but removes them for every other user.