Hide the WordPress Version Number
Removes the generator meta tag and the version from feeds, so the exact WordPress version is not advertised in your page source.
WPIDE Team 6 installs
Snippet Library
Security snippets for WordPress
Snippets that harden WordPress: turn off XML-RPC, hide the version number, stop user enumeration, add security headers and block risky uploads. Small, reviewable changes for site owners who want fewer attack points without a heavy security plugin.
Remove the Core Version From Script and Style URLs
Strips ?ver= from front-end CSS and JavaScript URLs when it equals the WordPress version, hiding it from the page source. Plugin and theme versions are left alone.
WPIDE Team 6 installsAllow Only Safe File Types to Be Uploaded
Limits uploads to common images, documents, audio and video, and rejects files with a hidden second extension such as photo.php.jpg.
Allow Your Site to Be Embedded Only on Partner Domains
Replaces the usual same-site framing rule with a Content-Security-Policy frame-ancestors list, so your pages can be shown in iframes on the partner sites you name and nowhere else.
Block Bad Bots by User Agent
Returns 403 Forbidden to aggressive SEO crawlers and scrapers that waste server resources, matched by their user agent.
Block Comments Posted Without Visiting Your Site
Rejects comment submissions that do not come from a page on your own site, which stops bots that post directly to wp-comments-post.php.
Block IP Addresses That Trigger Many 404 Errors
Temporarily blocks visitors who hit more than 20 missing pages within a minute, a typical sign of vulnerability scanners probing for old plugins and backup files.
Block Login Attempts From Scripts and Command-Line Tools
Refuses login, password reset and registration requests sent by tools such as curl, wget, python-requests or empty user agents, which real browsers never use and brute-force scripts often do.
Block TRACE, TRACK and Other Unusual HTTP Methods
Answers requests that use HTTP methods WordPress never needs (such as TRACE, TRACK, CONNECT or DEBUG) with a 405 error before any page is built.
Capability Audit for Risky Permissions
Adds Users > Capability Audit, listing every role other than Administrator and every user outside the administrator role that holds powerful permissions such as unfiltered HTML, plugin installation or user management.
Cross-Origin Opener Policy and Related Isolation Headers
Sends Cross-Origin-Opener-Policy, Origin-Agent-Cluster and X-Permitted-Cross-Domain-Policies headers on public pages, which stop other sites you link to or that open yours from reaching into your pages.
Hide Plugin and Theme Versions in Asset URLs
Replaces the ?ver= value on plugin and theme CSS and JavaScript files with a short hash, so scanners cannot read your exact plugin versions from the page source, while caches still refresh whenever a version changes.
Limit Guesses on Password-Protected Posts
Allows each visitor at most 10 password attempts on password-protected posts and pages every 15 minutes, which stops bots from brute-forcing the post password.
Limit How Many Files Non-Administrators Can Upload per Hour
Caps uploads at 30 files per hour for each user who is not an administrator, which limits the damage a compromised author account or a buggy front-end upload form can do.
Only Named Administrators Can Manage Plugins, Themes and Users
Limits installing, activating, editing and deleting plugins and themes, updating WordPress and managing users to the administrator accounts you list by user ID, even if other accounts have the administrator role.
Protect wp-login.php With a Secret Key
Hides the login page behind a secret link: wp-login.php returns "Not Found" unless you have opened it with your key once in this browser.
Redirect wp-admin to the Homepage for Logged-Out Visitors
Sends logged-out visitors who open /wp-admin/ to the homepage instead of the login page, so bots probing wp-admin do not learn where to log in.
Reject Login Attempts That Don't Come From Your Login Form
Refuses login form submissions that are not sent from a page on your own site, which stops many brute-force bots that post straight to wp-login.php.
Reject Uploads That Contain PHP Code
Scans every uploaded file that is not a PHP file for hidden PHP code (such as an image with a PHP payload) and refuses the upload if any is found.
Sandbox Iframes From Untrusted Sites in Your Content
Adds a restrictive sandbox to iframes in posts that come from sites not on your trusted list, so an embedded page cannot redirect your visitors, open pop-ups or run scripts against your site.
Security Headers for wp-admin and the Login Page
Sends nosniff, a strict referrer policy, a restrictive permissions policy and a cross-origin opener policy on dashboard and login pages, which front-end header snippets do not cover.
Send Comments in Foreign Scripts to Spam
Sends comments written mostly in Cyrillic, Chinese, Arabic or another script your readers do not use to the spam queue, where most of them belong.
Site Health Check for Security Headers
Adds a Site Health test that loads your homepage and reports which common security headers (HSTS, CSP, nosniff, framing, referrer and permissions policies) are missing.