Hide the WordPress Version Number
Removes the generator meta tag and the version from feeds, so the exact WordPress version is not advertised in your page source.
WPIDE Team 6 installs
Snippet Library
Security snippets for WordPress
Snippets that harden WordPress: turn off XML-RPC, hide the version number, stop user enumeration, add security headers and block risky uploads. Small, reviewable changes for site owners who want fewer attack points without a heavy security plugin.
Remove the Core Version From Script and Style URLs
Strips ?ver= from front-end CSS and JavaScript URLs when it equals the WordPress version, hiding it from the page source. Plugin and theme versions are left alone.
WPIDE Team 6 installsAlert When wp-config.php, .htaccess or Root Files Change
Checks your site's root folder once a day and emails the administrator when wp-config.php, .htaccess, .user.ini or php.ini change, or when new PHP files appear next to WordPress's own files.
Block TRACE, TRACK and Other Unusual HTTP Methods
Answers requests that use HTTP methods WordPress never needs (such as TRACE, TRACK, CONNECT or DEBUG) with a 405 error before any page is built.
Daily Core File Integrity Check
Compares your WordPress core files with the official checksums once a day and emails the administrator if any file was changed or is missing.
Lock the Site URL and Admin Email
Ignores changes to the WordPress Address, Site Address and administration email made from the dashboard, a common target after an account takeover.
Never Show Login Names as Public Display Names
When a user's public display name is the same as their login name (the WordPress default), switches it to their first and last name, or to a neutral name, so author bylines and comments do not reveal usernames.
Nonce-Based Content Security Policy for Scripts
Adds a fresh random nonce to every script WordPress prints and sends a strict, nonce-based script policy (report-only by default), the modern way to block injected scripts.
Only Named Administrators Can Manage Plugins, Themes and Users
Limits installing, activating, editing and deleting plugins and themes, updating WordPress and managing users to the administrator accounts you list by user ID, even if other accounts have the administrator role.
Protect wp-cron.php From Outside Requests
Requires a secret key for requests to wp-cron.php and adds that key automatically to WordPress's own cron calls, so outsiders cannot hammer the endpoint to slow your site down.
Reject Registrations Submitted Too Fast
Stamps the WordPress registration form with a signed time and refuses sign-ups sent within a few seconds of loading it, which stops most registration bots.
Remove Usernames From CSS Classes
Strips the author and commenter usernames WordPress adds to body and comment classes, closing a quiet way to discover login names.
Shorter Nonce Lifetime
Makes WordPress security tokens (nonces) expire after 4 hours instead of up to 24, shrinking the window in which a leaked link can be reused.
Strong Password Tip on the MemberPress Sign-Up Form
Adds a short tip about choosing a strong, unique password just above the MemberPress checkout button.
Warn About a Public debug.log File
Alerts administrators when WordPress writes errors to wp-content/debug.log, a file anyone can usually download and read.
Weekly Security Summary Email
Emails the administrator a short security summary every week: pending WordPress, plugin and theme updates, administrator accounts, new users of the week, inactive plugins and whether debug mode is on.