Snippet Library
Snippets that harden WordPress: turn off XML-RPC, hide the version number, stop user enumeration, add security headers and block risky uploads. Small, reviewable changes for site owners who want fewer attack points without a heavy security plugin.
Blocks REST API routes for logged-out visitors except the namespaces you list (for example oEmbed, contact forms and the WooCommerce Store API), shrinking the public attack surface without breaking front-end features.
Returns 403 Forbidden to aggressive SEO crawlers and scrapers that waste server resources, matched by their user agent.
Shows the same "check your email" screen for unknown usernames and emails on the lost password form, so it cannot be used to find valid accounts.
Adds an invisible field to the login and registration forms; bots that fill it in are rejected while people never see it.
Adds a hidden field to the lost password form that only bots fill in and silently ignores those requests, so bots cannot flood your users with reset emails.
Adds a hidden field to the comment form that only a real browser running JavaScript fills in; comments without it go to the spam queue instead of moderation.
Caps uploads at 30 files per hour for each user who is not an administrator, which limits the damage a compromised author account or a buggy front-end upload form can do.
Refuses login form submissions that are not sent from a page on your own site, which stops many brute-force bots that post straight to wp-login.php.
Stamps the WordPress registration form with a signed time and refuses sign-ups sent within a few seconds of loading it, which stops most registration bots.
Adds a small addition question to wp-login.php that bots fail, without third-party CAPTCHA services or cookies.
Adds a short tip about choosing a strong, unique password just above the MemberPress checkout button.