Alert When PHP Files Appear in the Uploads Folder
Scans the uploads folder once a day for PHP files, which never belong there and usually mean a backdoor, and emails the administrator and shows a dashboard warning when new ones show up.
Snippet Library
Security snippets for WordPress
Snippets that harden WordPress: turn off XML-RPC, hide the version number, stop user enumeration, add security headers and block risky uploads. Small, reviewable changes for site owners who want fewer attack points without a heavy security plugin.
Alert When wp-config.php, .htaccess or Root Files Change
Checks your site's root folder once a day and emails the administrator when wp-config.php, .htaccess, .user.ini or php.ini change, or when new PHP files appear next to WordPress's own files.
Alert the Site Owner When an Administrator's Email or Password Changes
Emails the site's admin address whenever any administrator account changes its email address or password, a key warning sign of an account takeover.
Allow the Administrator Role Only for Company Email Addresses
Refuses to give the administrator role to accounts whose email address is not on one of your approved domains, whether set from the profile screen, the Add User screen or a bulk role change.
Ask for the Current Password Before Changing Email or Password
Adds a "Current password" field to the profile screen and refuses changes to your own email address or password unless it is correct, so someone using an unattended logged-in browser cannot take over the account.
Daily Core File Integrity Check
Compares your WordPress core files with the official checksums once a day and emails the administrator if any file was changed or is missing.
Daily Email Summary of Failed Logins
Counts failed login attempts during the day (per username and IP address) and emails the administrator a short summary each morning, so you notice brute-force attacks without a flood of alerts.
Daily Plugin and Theme File Change Monitor
Fingerprints every PHP file in your plugins and themes once a day and emails the administrator a list of files that were added, changed or removed outside of normal updates.
Detect Administrator Accounts Added Behind Your Back
Keeps a list of approved administrator accounts and checks it daily and on every dashboard visit; administrators that appear any other way (for example inserted directly into the database by malware) trigger an email and a warning with an approve button.
Email Alert When Plugins Are Activated or Deactivated
Emails the site administrator whenever a plugin is turned on or off, with who did it and when.
Email Alert When a New Administrator Appears
Emails the site owner whenever an account is created as, or promoted to, administrator, which is often the first sign of a compromise.
Email Alert When an Administrator Logs In
Sends an email to the site admin address every time an administrator account logs in, with the time, IP address and browser.
Email Alerts When Application Passwords Are Created
Emails the user and the site administrator whenever a new application password is created for an account, since these passwords give API access that bypasses the normal login.
Hide Email Addresses From Spam Bots
Encodes every email address and mailto link in posts, widgets and comments so people see them normally but simple harvesting bots cannot read them.
Hide Whether an Account Exists on Password Reset
Shows the same "check your email" screen for unknown usernames and emails on the lost password form, so it cannot be used to find valid accounts.
Honeypot Trap on the Lost Password Form
Adds a hidden field to the lost password form that only bots fill in and silently ignores those requests, so bots cannot flood your users with reset emails.
Limit Password Reset Requests
Allows only a few password reset requests per hour from the same IP address, which stops reset-email flooding.
Lock the Site URL and Admin Email
Ignores changes to the WordPress Address, Site Address and administration email made from the dashboard, a common target after an account takeover.
Reject Registrations From Email Domains That Cannot Receive Mail
Checks that the email domain of every new registration has mail (MX) records, and refuses sign-ups from made-up or mistyped domains that bots and spammers often use.
Send Comments From Blocked Email Domains to Spam
Sends comments to the spam queue when the commenter's email address belongs to a throwaway inbox service or any other domain on your list.
Weekly Security Summary Email
Emails the administrator a short security summary every week: pending WordPress, plugin and theme updates, administrator accounts, new users of the week, inactive plugins and whether debug mode is on.