Email Alert When an Administrator Logs In
Sends an email to the site admin address every time an administrator account logs in, with the time, IP address and browser.
Snippet Library
Security snippets for WordPress
Snippets that harden WordPress: turn off XML-RPC, hide the version number, stop user enumeration, add security headers and block risky uploads. Small, reviewable changes for site owners who want fewer attack points without a heavy security plugin.
Email Alerts When Application Passwords Are Created
Emails the user and the site administrator whenever a new application password is created for an account, since these passwords give API access that bypasses the normal login.
Enable HTTP Strict Transport Security (HSTS)
Tells browsers to always use HTTPS for your domain for one year. Only enable it once the whole site, including subdomains you use, works over HTTPS.
Hide Email Addresses From Spam Bots
Encodes every email address and mailto link in posts, widgets and comments so people see them normally but simple harvesting bots cannot read them.
Hide Whether an Account Exists on Password Reset
Shows the same "check your email" screen for unknown usernames and emails on the lost password form, so it cannot be used to find valid accounts.
Honeypot Trap on the Lost Password Form
Adds a hidden field to the lost password form that only bots fill in and silently ignores those requests, so bots cannot flood your users with reset emails.
JavaScript Check Against Comment Spam Bots
Adds a hidden field to the comment form that only a real browser running JavaScript fills in; comments without it go to the spam queue instead of moderation.
Limit Password Reset Requests
Allows only a few password reset requests per hour from the same IP address, which stops reset-email flooding.
Lock the Site URL and Admin Email
Ignores changes to the WordPress Address, Site Address and administration email made from the dashboard, a common target after an account takeover.
Log Failed Logins
Keeps a log of the last 200 failed login attempts with username, IP address and time, viewable under Tools > Failed Logins.
Redirect All Traffic to HTTPS
Permanently redirects every plain HTTP request to the HTTPS version of the same URL, for sites whose host does not do it already.
Reject Login Attempts That Don't Come From Your Login Form
Refuses login form submissions that are not sent from a page on your own site, which stops many brute-force bots that post straight to wp-login.php.
Reject Registrations From Email Domains That Cannot Receive Mail
Checks that the email domain of every new registration has mail (MX) records, and refuses sign-ups from made-up or mistyped domains that bots and spammers often use.
Reject Requests for Unknown Host Names
Returns an error for requests whose Host header is not your site's domain, which blocks host header injection tricks (such as poisoned password reset links) and junk traffic aimed at your server's IP.
Reject Uploads That Contain PHP Code
Scans every uploaded file that is not a PHP file for hidden PHP code (such as an image with a PHP payload) and refuses the upload if any is found.
Sandbox Iframes From Untrusted Sites in Your Content
Adds a restrictive sandbox to iframes in posts that come from sites not on your trusted list, so an embedded page cannot redirect your visitors, open pop-ups or run scripts against your site.
Secure Checkout Note Above the Pay Button
Reassures shoppers right above the WooCommerce payment button that the connection is encrypted and card details are handled by the payment provider.
Send Comments From Blocked Email Domains to Spam
Sends comments to the spam queue when the commenter's email address belongs to a throwaway inbox service or any other domain on your list.
Simple Math Question on the Login Form
Adds a small addition question to wp-login.php that bots fail, without third-party CAPTCHA services or cookies.
Slow Down Failed Login Attempts
Waits a second or two before answering a failed login, which makes password-guessing bots far slower without bothering real users.
Spam Comments Linking to Suspicious Domains
Sends comments to spam when the commenter's website field points to a domain ending you have chosen to distrust, such as .xyz, .top or .click.
Weekly Security Summary Email
Emails the administrator a short security summary every week: pending WordPress, plugin and theme updates, administrator accounts, new users of the week, inactive plugins and whether debug mode is on.