Block Login Attempts From Scripts and Command-Line Tools
Refuses login, password reset and registration requests sent by tools such as curl, wget, python-requests or empty user agents, which real browsers never use and brute-force scripts often do.
Snippet Library
Security snippets for WordPress
Snippets that harden WordPress: turn off XML-RPC, hide the version number, stop user enumeration, add security headers and block risky uploads. Small, reviewable changes for site owners who want fewer attack points without a heavy security plugin.
Emergency Lockdown Switch
Adds a "Lockdown" toggle to the admin bar for administrators. While it is on, only administrators can log in, everyone else is logged out, registration and comments are closed and XML-RPC is off.
Honeypot Trap for Login and Registration Forms
Adds an invisible field to the login and registration forms; bots that fill it in are rejected while people never see it.
Lock Registration and Default Role Settings
Forces "Anyone can register" and the default new user role to fixed values in code, so an attacker or a mistake cannot open admin-level sign-ups.
Reject Registrations From Email Domains That Cannot Receive Mail
Checks that the email domain of every new registration has mail (MX) records, and refuses sign-ups from made-up or mistyped domains that bots and spammers often use.
Reject Registrations Submitted Too Fast
Stamps the WordPress registration form with a signed time and refuses sign-ups sent within a few seconds of loading it, which stops most registration bots.