Redirect All Traffic to HTTPS
Permanently redirects every plain HTTP request to the HTTPS version of the same URL, for sites whose host does not do it already.
Snippet Library
Security snippets for WordPress
Snippets that harden WordPress: turn off XML-RPC, hide the version number, stop user enumeration, add security headers and block risky uploads. Small, reviewable changes for site owners who want fewer attack points without a heavy security plugin.
Redirect wp-admin to the Homepage for Logged-Out Visitors
Sends logged-out visitors who open /wp-admin/ to the homepage instead of the login page, so bots probing wp-admin do not learn where to log in.
Sandbox Iframes From Untrusted Sites in Your Content
Adds a restrictive sandbox to iframes in posts that come from sites not on your trusted list, so an embedded page cannot redirect your visitors, open pop-ups or run scripts against your site.