Require Strong Passwords for Editors and Administrators
Requires at least 12 characters with letters, numbers and a symbol or mixed case for users who can edit other people's content.
Snippet Library
Security snippets for WordPress
Snippets that harden WordPress: turn off XML-RPC, hide the version number, stop user enumeration, add security headers and block risky uploads. Small, reviewable changes for site owners who want fewer attack points without a heavy security plugin.
Sandbox Iframes From Untrusted Sites in Your Content
Adds a restrictive sandbox to iframes in posts that come from sites not on your trusted list, so an embedded page cannot redirect your visitors, open pop-ups or run scripts against your site.
Send Comments From Blocked Email Domains to Spam
Sends comments to the spam queue when the commenter's email address belongs to a throwaway inbox service or any other domain on your list.
Serve a security.txt File
Publishes /.well-known/security.txt so security researchers know how to report a vulnerability on your site responsibly.
Shorter Nonce Lifetime
Makes WordPress security tokens (nonces) expire after 4 hours instead of up to 24, shrinking the window in which a leaked link can be reused.
Site Health Check for Publicly Exposed Sensitive Files
Adds a Site Health test that checks whether files such as .env, debug.log, .git/HEAD and wp-config.php backups can be downloaded from your site by anyone, and flags them as critical.
Spam Comments Copied Across Several Posts
Sends a comment to spam when exactly the same text was already posted on another post in the last day, a typical sign of a spam bot working through your site.
Spam Comments Linking to Suspicious Domains
Sends comments to spam when the commenter's website field points to a domain ending you have chosen to distrust, such as .xyz, .top or .click.
Stop Author URLs From Revealing Login Names
Gives new users an author URL slug based on their user ID instead of their login name, and adds a one-click fix under Users for existing accounts whose author URL shows their username.
Warn When There Are Too Many Administrators
Shows a dashboard notice listing the administrator accounts when there are more than you expect, a prompt to downgrade old or unused ones.