Limit Failed Login Attempts
Temporarily blocks an IP address after 5 failed logins within 15 minutes. A lightweight brute-force guard with no settings screen.
WPIDE Team 6 installs
Snippet Library
Security snippets for WordPress
Snippets that harden WordPress: turn off XML-RPC, hide the version number, stop user enumeration, add security headers and block risky uploads. Small, reviewable changes for site owners who want fewer attack points without a heavy security plugin.
Activity Log in Its Own Database Table
Records logins, failed logins, content changes, plugin, theme and user changes and edits to key settings in a dedicated database table, with a searchable, paginated log under Tools > Activity Log and automatic cleanup.
Alert When PHP Files Appear in the Uploads Folder
Scans the uploads folder once a day for PHP files, which never belong there and usually mean a backdoor, and emails the administrator and shows a dashboard warning when new ones show up.
Alert When wp-config.php, .htaccess or Root Files Change
Checks your site's root folder once a day and emails the administrator when wp-config.php, .htaccess, .user.ini or php.ini change, or when new PHP files appear next to WordPress's own files.
Alert the Site Owner When an Administrator's Email or Password Changes
Emails the site's admin address whenever any administrator account changes its email address or password, a key warning sign of an account takeover.
Allow XML-RPC Only From Trusted IP Addresses
Keeps XML-RPC available for the services you list (such as Jetpack or a publishing app on your office network) while answering every other XML-RPC request with a 403 error.
Allow Your Site to Be Embedded Only on Partner Domains
Replaces the usual same-site framing rule with a Content-Security-Policy frame-ancestors list, so your pages can be shown in iframes on the partner sites you name and nowhere else.
Allow the Administrator Role Only for Company Email Addresses
Refuses to give the administrator role to accounts whose email address is not on one of your approved domains, whether set from the profile screen, the Add User screen or a bulk role change.
Application Passwords for Administrators Only
Keeps Application Passwords available for administrators (for integrations and apps) but removes them for every other user.
Ask for the Current Password Before Changing Email or Password
Adds a "Current password" field to the profile screen and refuses changes to your own email address or password unless it is correct, so someone using an unattended logged-in browser cannot take over the account.
Ask for the Password Again Before Sensitive Admin Screens
Requires administrators to log in again before opening plugin, theme, user and update screens when their login is older than 30 minutes, so a hijacked session cannot quietly install code or add users.
Automatic Updates for the Plugins You Trust Most
Turns on automatic background updates for the plugins you list (for example your security and backup plugins), so security fixes for them are installed within hours without waiting for you.
Block Common and Guessable Passwords
Rejects the most common passwords, and passwords containing the username or site name, when users set or reset their password.
Block Fake Googlebot Visits
Checks visitors that claim to be Googlebot with a reverse DNS lookup and blocks the impostors, which are usually scrapers or vulnerability scanners.
Block Malicious Request Patterns
A tiny firewall that returns 403 Forbidden for URLs containing typical attack strings, such as directory traversal, SQL injection and PHP stream wrappers.
Block Passwords Found in Known Data Breaches
Checks new passwords against the Have I Been Pwned database of breached passwords when users change or reset them, and asks for a different one if it appears there.
Cross-Origin Opener Policy and Related Isolation Headers
Sends Cross-Origin-Opener-Policy, Origin-Agent-Cluster and X-Permitted-Cross-Domain-Policies headers on public pages, which stop other sites you link to or that open yours from reaching into your pages.
Daily Comment Limit per Visitor
Holds comments for moderation once a single IP address has posted more than a set number of comments in 24 hours, which stops comment floods and spam runs.
Daily Core File Integrity Check
Compares your WordPress core files with the official checksums once a day and emails the administrator if any file was changed or is missing.
Daily Email Summary of Failed Logins
Counts failed login attempts during the day (per username and IP address) and emails the administrator a short summary each morning, so you notice brute-force attacks without a flood of alerts.
Daily Plugin and Theme File Change Monitor
Fingerprints every PHP file in your plugins and themes once a day and emails the administrator a list of files that were added, changed or removed outside of normal updates.
Detect Administrator Accounts Added Behind Your Back
Keeps a list of approved administrator accounts and checks it daily and on every dashboard visit; administrators that appear any other way (for example inserted directly into the database by malware) trigger an email and a warning with an approve button.
Email Alert When Plugins Are Activated or Deactivated
Emails the site administrator whenever a plugin is turned on or off, with who did it and when.
Email Alert When a New Administrator Appears
Emails the site owner whenever an account is created as, or promoted to, administrator, which is often the first sign of a compromise.