Limit Failed Login Attempts
Temporarily blocks an IP address after 5 failed logins within 15 minutes. A lightweight brute-force guard with no settings screen.
WPIDE Team 6 installs
Snippet Library
Security snippets for WordPress
Snippets that harden WordPress: turn off XML-RPC, hide the version number, stop user enumeration, add security headers and block risky uploads. Small, reviewable changes for site owners who want fewer attack points without a heavy security plugin.
Allow Only Chosen REST API Namespaces for Visitors
Blocks REST API routes for logged-out visitors except the namespaces you list (for example oEmbed, contact forms and the WooCommerce Store API), shrinking the public attack surface without breaking front-end features.
Ban IPs That Try Common Attack Usernames
Blocks an IP address from logging in for a day as soon as it tries a username like "admin" or "test" that does not exist on your site.
Block Fake Googlebot Visits
Checks visitors that claim to be Googlebot with a reverse DNS lookup and blocks the impostors, which are usually scrapers or vulnerability scanners.
Block IP Addresses That Trigger Many 404 Errors
Temporarily blocks visitors who hit more than 20 missing pages within a minute, a typical sign of vulnerability scanners probing for old plugins and backup files.
Bot Trap Link That Blocks Misbehaving Crawlers
Adds an invisible link that real visitors never see and well-behaved search engines are told to skip; any client that requests it anyway is blocked from the site for 24 hours.
End Admin Sessions When the IP Address Changes
Logs an administrator out if their session suddenly comes from a different IP address than the one they logged in from, which blocks stolen cookies.
Hide the REST Users Endpoint From Subscribers and Customers
Blocks the REST API users endpoint for logged-in users who cannot edit posts, such as subscribers and shop customers, so a low-level account cannot list your authors and their usernames.
Reject Requests for Unknown Host Names
Returns an error for requests whose Host header is not your site's domain, which blocks host header injection tricks (such as poisoned password reset links) and junk traffic aimed at your server's IP.