Disable the Theme and Plugin File Editors
Turns off the built-in Theme File Editor and Plugin File Editor screens, so a hijacked admin account cannot inject code through them.
WPIDE Team 6 installs
Snippet Library
Security snippets for WordPress
Snippets that harden WordPress: turn off XML-RPC, hide the version number, stop user enumeration, add security headers and block risky uploads. Small, reviewable changes for site owners who want fewer attack points without a heavy security plugin.
Prevent Installing New Plugins and Themes
Removes the ability to install or upload new plugins and themes for every user, while still allowing updates of what is already installed.
WPIDE Team 6 installsRemove the Core Version From Script and Style URLs
Strips ?ver= from front-end CSS and JavaScript URLs when it equals the WordPress version, hiding it from the page source. Plugin and theme versions are left alone.
WPIDE Team 6 installsActivity Log in Its Own Database Table
Records logins, failed logins, content changes, plugin, theme and user changes and edits to key settings in a dedicated database table, with a searchable, paginated log under Tools > Activity Log and automatic cleanup.
Ask for the Password Again Before Sensitive Admin Screens
Requires administrators to log in again before opening plugin, theme, user and update screens when their login is older than 30 minutes, so a hijacked session cannot quietly install code or add users.
Daily Plugin and Theme File Change Monitor
Fingerprints every PHP file in your plugins and themes once a day and emails the administrator a list of files that were added, changed or removed outside of normal updates.
Hide Plugin and Theme Versions in Asset URLs
Replaces the ?ver= value on plugin and theme CSS and JavaScript files with a short hash, so scanners cannot read your exact plugin versions from the page source, while caches still refresh whenever a version changes.
Only Named Administrators Can Manage Plugins, Themes and Users
Limits installing, activating, editing and deleting plugins and themes, updating WordPress and managing users to the administrator accounts you list by user ID, even if other accounts have the administrator role.
Simple Admin Activity Log
Records logins, plugin and theme changes, updates, role changes and deleted content, and lists the last 300 events under Tools > Activity Log.
Weekly Security Summary Email
Emails the administrator a short security summary every week: pending WordPress, plugin and theme updates, administrator accounts, new users of the week, inactive plugins and whether debug mode is on.