Hide the WordPress Version Number
Removes the generator meta tag and the version from feeds, so the exact WordPress version is not advertised in your page source.
WPIDE Team 6 installs
Snippet Library
Security snippets for WordPress
Snippets that harden WordPress: turn off XML-RPC, hide the version number, stop user enumeration, add security headers and block risky uploads. Small, reviewable changes for site owners who want fewer attack points without a heavy security plugin.
Remove the Core Version From Script and Style URLs
Strips ?ver= from front-end CSS and JavaScript URLs when it equals the WordPress version, hiding it from the page source. Plugin and theme versions are left alone.
WPIDE Team 6 installsAllow Only Safe File Types to Be Uploaded
Limits uploads to common images, documents, audio and video, and rejects files with a hidden second extension such as photo.php.jpg.
Block Bad Bots by User Agent
Returns 403 Forbidden to aggressive SEO crawlers and scrapers that waste server resources, matched by their user agent.
Block Malicious Request Patterns
A tiny firewall that returns 403 Forbidden for URLs containing typical attack strings, such as directory traversal, SQL injection and PHP stream wrappers.
Capability Audit for Risky Permissions
Adds Users > Capability Audit, listing every role other than Administrator and every user outside the administrator role that holds powerful permissions such as unfiltered HTML, plugin installation or user management.
Daily Plugin and Theme File Change Monitor
Fingerprints every PHP file in your plugins and themes once a day and emails the administrator a list of files that were added, changed or removed outside of normal updates.
Email Alert When Plugins Are Activated or Deactivated
Emails the site administrator whenever a plugin is turned on or off, with who did it and when.
Hide Email Addresses From Spam Bots
Encodes every email address and mailto link in posts, widgets and comments so people see them normally but simple harvesting bots cannot read them.
Hide PHP Errors From Visitors
Turns off on-screen PHP warnings and errors for everyone except logged-in administrators, so file paths are never shown to the public.
Hide Plugin and Theme Versions in Asset URLs
Replaces the ?ver= value on plugin and theme CSS and JavaScript files with a short hash, so scanners cannot read your exact plugin versions from the page source, while caches still refresh whenever a version changes.
Hide Whether an Account Exists on Password Reset
Shows the same "check your email" screen for unknown usernames and emails on the lost password form, so it cannot be used to find valid accounts.
Hide the REST API Index From Visitors
Stops logged-out visitors from listing every REST API route and plugin namespace at /wp-json/, while the routes themselves keep working.
Hide the REST Users Endpoint From Subscribers and Customers
Blocks the REST API users endpoint for logged-in users who cannot edit posts, such as subscribers and shop customers, so a low-level account cannot list your authors and their usernames.
Honeypot Trap on the Lost Password Form
Adds a hidden field to the lost password form that only bots fill in and silently ignores those requests, so bots cannot flood your users with reset emails.
JavaScript Check Against Comment Spam Bots
Adds a hidden field to the comment form that only a real browser running JavaScript fills in; comments without it go to the spam queue instead of moderation.
Only Named Administrators Can Manage Plugins, Themes and Users
Limits installing, activating, editing and deleting plugins and themes, updating WordPress and managing users to the administrator accounts you list by user ID, even if other accounts have the administrator role.
Prevent Deactivating Essential Plugins
Removes the Deactivate option for the plugins you list, for every user, so key functionality cannot be switched off by accident.
Protect wp-cron.php From Outside Requests
Requires a secret key for requests to wp-cron.php and adds that key automatically to WordPress's own cron calls, so outsiders cannot hammer the endpoint to slow your site down.
Protect wp-login.php With a Secret Key
Hides the login page behind a secret link: wp-login.php returns "Not Found" unless you have opened it with your key once in this browser.
Reject Uploads That Contain PHP Code
Scans every uploaded file that is not a PHP file for hidden PHP code (such as an image with a PHP payload) and refuses the upload if any is found.
Secure Checkout Note Above the Pay Button
Reassures shoppers right above the WooCommerce payment button that the connection is encrypted and card details are handled by the payment provider.
Stop Author URLs From Revealing Login Names
Gives new users an author URL slug based on their user ID instead of their login name, and adds a one-click fix under Users for existing accounts whose author URL shows their username.