Disable the Theme and Plugin File Editors
Turns off the built-in Theme File Editor and Plugin File Editor screens, so a hijacked admin account cannot inject code through them.
WPIDE Team 6 installs
Snippet Library
Security snippets for WordPress
Snippets that harden WordPress: turn off XML-RPC, hide the version number, stop user enumeration, add security headers and block risky uploads. Small, reviewable changes for site owners who want fewer attack points without a heavy security plugin.
Alert the Site Owner When an Administrator's Email or Password Changes
Emails the site's admin address whenever any administrator account changes its email address or password, a key warning sign of an account takeover.
Allow the Administrator Role Only for Company Email Addresses
Refuses to give the administrator role to accounts whose email address is not on one of your approved domains, whether set from the profile screen, the Add User screen or a bulk role change.
Ask for the Current Password Before Changing Email or Password
Adds a "Current password" field to the profile screen and refuses changes to your own email address or password unless it is correct, so someone using an unattended logged-in browser cannot take over the account.
Detect Administrator Accounts Added Behind Your Back
Keeps a list of approved administrator accounts and checks it daily and on every dashboard visit; administrators that appear any other way (for example inserted directly into the database by malware) trigger an email and a warning with an approve button.
Email Alert When a New Administrator Appears
Emails the site owner whenever an account is created as, or promoted to, administrator, which is often the first sign of a compromise.
Email Alert When an Administrator Logs In
Sends an email to the site admin address every time an administrator account logs in, with the time, IP address and browser.
Email Alerts When Application Passwords Are Created
Emails the user and the site administrator whenever a new application password is created for an account, since these passwords give API access that bypasses the normal login.
Hide Whether an Account Exists on Password Reset
Shows the same "check your email" screen for unknown usernames and emails on the lost password form, so it cannot be used to find valid accounts.
Hide the REST Users Endpoint From Subscribers and Customers
Blocks the REST API users endpoint for logged-in users who cannot edit posts, such as subscribers and shop customers, so a low-level account cannot list your authors and their usernames.
Limit How Many Files Non-Administrators Can Upload per Hour
Caps uploads at 30 files per hour for each user who is not an administrator, which limits the damage a compromised author account or a buggy front-end upload form can do.
Lock the Site URL and Admin Email
Ignores changes to the WordPress Address, Site Address and administration email made from the dashboard, a common target after an account takeover.
Only Named Administrators Can Manage Plugins, Themes and Users
Limits installing, activating, editing and deleting plugins and themes, updating WordPress and managing users to the administrator accounts you list by user ID, even if other accounts have the administrator role.
Site Health Checks for Weak Security Settings
Adds Site Health tests for common weak spots: default or reused security keys, an account named "admin", the file editor left enabled, and a world-readable wp-config.php file.
Stop Author URLs From Revealing Login Names
Gives new users an author URL slug based on their user ID instead of their login name, and adds a one-click fix under Users for existing accounts whose author URL shows their username.
Warn When There Are Too Many Administrators
Shows a dashboard notice listing the administrator accounts when there are more than you expect, a prompt to downgrade old or unused ones.
Weekly Security Summary Email
Emails the administrator a short security summary every week: pending WordPress, plugin and theme updates, administrator accounts, new users of the week, inactive plugins and whether debug mode is on.