Accept Application Passwords Only From Trusted IP Addresses
Rejects REST API and XML-RPC logins made with application passwords unless they come from the IP addresses or networks you list, such as your office, CI server or integration partner.
Snippet Library
Security snippets for WordPress
Snippets that harden WordPress: turn off XML-RPC, hide the version number, stop user enumeration, add security headers and block risky uploads. Small, reviewable changes for site owners who want fewer attack points without a heavy security plugin.
Alert the Site Owner When an Administrator's Email or Password Changes
Emails the site's admin address whenever any administrator account changes its email address or password, a key warning sign of an account takeover.
Application Passwords for Administrators Only
Keeps Application Passwords available for administrators (for integrations and apps) but removes them for every other user.
Ask for the Current Password Before Changing Email or Password
Adds a "Current password" field to the profile screen and refuses changes to your own email address or password unless it is correct, so someone using an unattended logged-in browser cannot take over the account.
Ask for the Password Again Before Sensitive Admin Screens
Requires administrators to log in again before opening plugin, theme, user and update screens when their login is older than 30 minutes, so a hijacked session cannot quietly install code or add users.
Block Common and Guessable Passwords
Rejects the most common passwords, and passwords containing the username or site name, when users set or reset their password.
Block Login Attempts From Scripts and Command-Line Tools
Refuses login, password reset and registration requests sent by tools such as curl, wget, python-requests or empty user agents, which real browsers never use and brute-force scripts often do.
Block Passwords Found in Known Data Breaches
Checks new passwords against the Have I Been Pwned database of breached passwords when users change or reset them, and asks for a different one if it appears there.
Disable Application Passwords
Removes the Application Passwords feature, which lets external apps authenticate to the REST API. Disable it if you do not use it.
Disable XML-RPC Multicall
Removes the XML-RPC system.multicall method, which attackers use to try hundreds of passwords in a single request, while XML-RPC keeps working for apps and Jetpack.
Email Alerts When Application Passwords Are Created
Emails the user and the site administrator whenever a new application password is created for an account, since these passwords give API access that bypasses the normal login.
Forget Post Passwords When the Browser Closes
Makes the cookie that remembers a protected post's password last only until the browser is closed, instead of the default 10 days, which matters on shared and public computers.
Hide Whether an Account Exists on Password Reset
Shows the same "check your email" screen for unknown usernames and emails on the lost password form, so it cannot be used to find valid accounts.
Honeypot Trap on the Lost Password Form
Adds a hidden field to the lost password form that only bots fill in and silently ignores those requests, so bots cannot flood your users with reset emails.
Limit Guesses on Password-Protected Posts
Allows each visitor at most 10 password attempts on password-protected posts and pages every 15 minutes, which stops bots from brute-forcing the post password.
Limit Password Reset Requests
Allows only a few password reset requests per hour from the same IP address, which stops reset-email flooding.
Prevent Reusing Any of the Last 5 Passwords
Remembers the last five password hashes of each user and refuses a new password that matches one of them, on the profile screen and on password reset.
Reject Requests for Unknown Host Names
Returns an error for requests whose Host header is not your site's domain, which blocks host header injection tricks (such as poisoned password reset links) and junk traffic aimed at your server's IP.
Remind Administrators to Change Old Passwords
Shows administrators a reminder when they have not changed their password for 180 days.
Require Strong Passwords for Editors and Administrators
Requires at least 12 characters with letters, numbers and a symbol or mixed case for users who can edit other people's content.
Slow Down Failed Login Attempts
Waits a second or two before answering a failed login, which makes password-guessing bots far slower without bothering real users.
Strong Password Tip on the MemberPress Sign-Up Form
Adds a short tip about choosing a strong, unique password just above the MemberPress checkout button.