Limit Failed Login Attempts
Temporarily blocks an IP address after 5 failed logins within 15 minutes. A lightweight brute-force guard with no settings screen.
WPIDE Team 6 installs
Snippet Library
Security snippets for WordPress
Snippets that harden WordPress: turn off XML-RPC, hide the version number, stop user enumeration, add security headers and block risky uploads. Small, reviewable changes for site owners who want fewer attack points without a heavy security plugin.
Remove the Core Version From Script and Style URLs
Strips ?ver= from front-end CSS and JavaScript URLs when it equals the WordPress version, hiding it from the page source. Plugin and theme versions are left alone.
WPIDE Team 6 installsRestrict Unfiltered HTML to Administrators
Only administrators may save raw HTML such as scripts and iframes in posts. Editors get the same safe HTML filtering as authors.
WPIDE Team 6 installsAccept Application Passwords Only From Trusted IP Addresses
Rejects REST API and XML-RPC logins made with application passwords unless they come from the IP addresses or networks you list, such as your office, CI server or integration partner.
Active Login Sessions Overview
Adds Users > Active Sessions, listing everyone who is currently logged in with their login time, IP address and browser, and lets you end a user's sessions with one click.
Allow Administrator Logins Only From Trusted IPs
Administrators can only log in from the IP addresses or ranges you list; everyone else logs in as usual.
Allow XML-RPC Only From Trusted IP Addresses
Keeps XML-RPC available for the services you list (such as Jetpack or a publishing app on your office network) while answering every other XML-RPC request with a 403 error.
Ban IPs That Try Common Attack Usernames
Blocks an IP address from logging in for a day as soon as it tries a username like "admin" or "test" that does not exist on your site.
Block IP Addresses That Trigger Many 404 Errors
Temporarily blocks visitors who hit more than 20 missing pages within a minute, a typical sign of vulnerability scanners probing for old plugins and backup files.
Block IP Addresses and Ranges
Denies access to the whole site for the IP addresses and IPv4 ranges you list, for example a persistent spammer or attacker.
Block Login Attempts From Scripts and Command-Line Tools
Refuses login, password reset and registration requests sent by tools such as curl, wget, python-requests or empty user agents, which real browsers never use and brute-force scripts often do.
Block PHP Execution in the Uploads Folder (Apache)
Adds Tools > Uploads Protection with a button that writes .htaccess rules to your uploads folder so PHP files there can never be run, even if one slips through an upload.
Bot Trap Link That Blocks Misbehaving Crawlers
Adds an invisible link that real visitors never see and well-behaved search engines are told to skip; any client that requests it anyway is blocked from the site for 24 hours.
Daily Comment Limit per Visitor
Holds comments for moderation once a single IP address has posted more than a set number of comments in 24 hours, which stops comment floods and spam runs.
Daily Email Summary of Failed Logins
Counts failed login attempts during the day (per username and IP address) and emails the administrator a short summary each morning, so you notice brute-force attacks without a flood of alerts.
Email Alert When an Administrator Logs In
Sends an email to the site admin address every time an administrator account logs in, with the time, IP address and browser.
End Admin Sessions When the IP Address Changes
Logs an administrator out if their session suddenly comes from a different IP address than the one they logged in from, which blocks stolen cookies.
Hide Plugin and Theme Versions in Asset URLs
Replaces the ?ver= value on plugin and theme CSS and JavaScript files with a short hash, so scanners cannot read your exact plugin versions from the page source, while caches still refresh whenever a version changes.
JavaScript Check Against Comment Spam Bots
Adds a hidden field to the comment form that only a real browser running JavaScript fills in; comments without it go to the spam queue instead of moderation.
Limit Password Reset Requests
Allows only a few password reset requests per hour from the same IP address, which stops reset-email flooding.
Log Failed Logins
Keeps a log of the last 200 failed login attempts with username, IP address and time, viewable under Tools > Failed Logins.
Nonce-Based Content Security Policy for Scripts
Adds a fresh random nonce to every script WordPress prints and sends a strict, nonce-based script policy (report-only by default), the modern way to block injected scripts.
Reject Requests for Unknown Host Names
Returns an error for requests whose Host header is not your site's domain, which blocks host header injection tricks (such as poisoned password reset links) and junk traffic aimed at your server's IP.
Remove Usernames From CSS Classes
Strips the author and commenter usernames WordPress adds to body and comment classes, closing a quiet way to discover login names.