Active Login Sessions Overview
Adds Users > Active Sessions, listing everyone who is currently logged in with their login time, IP address and browser, and lets you end a user's sessions with one click.
Snippet Library
Security snippets for WordPress
Snippets that harden WordPress: turn off XML-RPC, hide the version number, stop user enumeration, add security headers and block risky uploads. Small, reviewable changes for site owners who want fewer attack points without a heavy security plugin.
Email Alert When an Administrator Logs In
Sends an email to the site admin address every time an administrator account logs in, with the time, IP address and browser.
Log Failed Logins
Keeps a log of the last 200 failed login attempts with username, IP address and time, viewable under Tools > Failed Logins.
Reject Registrations Submitted Too Fast
Stamps the WordPress registration form with a signed time and refuses sign-ups sent within a few seconds of loading it, which stops most registration bots.
Shorter Nonce Lifetime
Makes WordPress security tokens (nonces) expire after 4 hours instead of up to 24, shrinking the window in which a leaked link can be reused.