"Log Out Everyone" Button for Emergencies
Adds a button under Tools > Log Out Everyone that ends every login session on the site except your own, useful after a suspected break-in or a staff change.
Snippet Library
Security snippets for WordPress
Snippets that harden WordPress: turn off XML-RPC, hide the version number, stop user enumeration, add security headers and block risky uploads. Small, reviewable changes for site owners who want fewer attack points without a heavy security plugin.
Activity Log in Its Own Database Table
Records logins, failed logins, content changes, plugin, theme and user changes and edits to key settings in a dedicated database table, with a searchable, paginated log under Tools > Activity Log and automatic cleanup.
Block Login Attempts From Scripts and Command-Line Tools
Refuses login, password reset and registration requests sent by tools such as curl, wget, python-requests or empty user agents, which real browsers never use and brute-force scripts often do.
Block PHP Execution in the Uploads Folder (Apache)
Adds Tools > Uploads Protection with a button that writes .htaccess rules to your uploads folder so PHP files there can never be run, even if one slips through an upload.
Content Security Policy Builder With Violation Reports
Sends a report-only Content Security Policy and collects the browser's violation reports, then lists every blocked source per directive under Tools > CSP Reports with a suggested policy you can enforce later.
Log Failed Logins
Keeps a log of the last 200 failed login attempts with username, IP address and time, viewable under Tools > Failed Logins.
Simple Admin Activity Log
Records logins, plugin and theme changes, updates, role changes and deleted content, and lists the last 300 events under Tools > Activity Log.