Snippet Library
Snippets that harden WordPress: turn off XML-RPC, hide the version number, stop user enumeration, add security headers and block risky uploads. Small, reviewable changes for site owners who want fewer attack points without a heavy security plugin.
Refuses to give the administrator role to accounts whose email address is not on one of your approved domains, whether set from the profile screen, the Add User screen or a bulk role change.
Counts failed login attempts during the day (per username and IP address) and emails the administrator a short summary each morning, so you notice brute-force attacks without a flood of alerts.
Keeps a list of approved administrator accounts and checks it daily and on every dashboard visit; administrators that appear any other way (for example inserted directly into the database by malware) trigger an email and a warning with an approve button.
Shows the same "check your email" screen for unknown usernames and emails on the lost password form, so it cannot be used to find valid accounts.
Limits installing, activating, editing and deleting plugins and themes, updating WordPress and managing users to the administrator accounts you list by user ID, even if other accounts have the administrator role.
Gives new users an author URL slug based on their user ID instead of their login name, and adds a one-click fix under Users for existing accounts whose author URL shows their username.
Shows a dashboard notice listing the administrator accounts when there are more than you expect, a prompt to downgrade old or unused ones.
Emails the administrator a short security summary every week: pending WordPress, plugin and theme updates, administrator accounts, new users of the week, inactive plugins and whether debug mode is on.