Accept Application Passwords Only From Trusted IP Addresses
Rejects REST API and XML-RPC logins made with application passwords unless they come from the IP addresses or networks you list, such as your office, CI server or integration partner.
Snippet Library
Security snippets for WordPress
Snippets that harden WordPress: turn off XML-RPC, hide the version number, stop user enumeration, add security headers and block risky uploads. Small, reviewable changes for site owners who want fewer attack points without a heavy security plugin.
Allow Administrator Logins Only From Trusted IPs
Administrators can only log in from the IP addresses or ranges you list; everyone else logs in as usual.
Allow XML-RPC Only From Trusted IP Addresses
Keeps XML-RPC available for the services you list (such as Jetpack or a publishing app on your office network) while answering every other XML-RPC request with a 403 error.
Automatic Updates for the Plugins You Trust Most
Turns on automatic background updates for the plugins you list (for example your security and backup plugins), so security fixes for them are installed within hours without waiting for you.
Sandbox Iframes From Untrusted Sites in Your Content
Adds a restrictive sandbox to iframes in posts that come from sites not on your trusted list, so an embedded page cannot redirect your visitors, open pop-ups or run scripts against your site.
Spam Comments Linking to Suspicious Domains
Sends comments to spam when the commenter's website field points to a domain ending you have chosen to distrust, such as .xyz, .top or .click.