Restrict Unfiltered HTML to Administrators
Only administrators may save raw HTML such as scripts and iframes in posts. Editors get the same safe HTML filtering as authors.
WPIDE Team 6 installs
Snippet Library
Security snippets for WordPress
Snippets that harden WordPress: turn off XML-RPC, hide the version number, stop user enumeration, add security headers and block risky uploads. Small, reviewable changes for site owners who want fewer attack points without a heavy security plugin.
Send Basic Security Headers
Adds common HTTP security headers to front-end responses: nosniff, same-origin framing, a strict referrer policy and a restrictive permissions policy.
WPIDE Team 6 installsRestrict the REST API to Logged-In Users
Returns an authentication error for REST API requests from visitors who are not logged in, with an allowlist for routes your site needs publicly.
Sandbox Iframes From Untrusted Sites in Your Content
Adds a restrictive sandbox to iframes in posts that come from sites not on your trusted list, so an embedded page cannot redirect your visitors, open pop-ups or run scripts against your site.
Security Headers for wp-admin and the Login Page
Sends nosniff, a strict referrer policy, a restrictive permissions policy and a cross-origin opener policy on dashboard and login pages, which front-end header snippets do not cover.