Remove Usernames From CSS Classes
Strips the author and commenter usernames WordPress adds to body and comment classes, closing a quiet way to discover login names.
Snippet Library
Security snippets for WordPress
Snippets that harden WordPress: turn off XML-RPC, hide the version number, stop user enumeration, add security headers and block risky uploads. Small, reviewable changes for site owners who want fewer attack points without a heavy security plugin.
Restrict the REST API to Logged-In Users
Returns an authentication error for REST API requests from visitors who are not logged in, with an allowlist for routes your site needs publicly.
Sandbox Iframes From Untrusted Sites in Your Content
Adds a restrictive sandbox to iframes in posts that come from sites not on your trusted list, so an embedded page cannot redirect your visitors, open pop-ups or run scripts against your site.
Send Comments From Blocked Email Domains to Spam
Sends comments to the spam queue when the commenter's email address belongs to a throwaway inbox service or any other domain on your list.
Site Health Check for Publicly Exposed Sensitive Files
Adds a Site Health test that checks whether files such as .env, debug.log, .git/HEAD and wp-config.php backups can be downloaded from your site by anyone, and flags them as critical.
Stop Author URLs From Revealing Login Names
Gives new users an author URL slug based on their user ID instead of their login name, and adds a one-click fix under Users for existing accounts whose author URL shows their username.
Subresource Integrity for Scripts and Styles From CDNs
Adds integrity and crossorigin attributes to the CDN-hosted scripts and stylesheets you list, so browsers refuse to run them if the CDN copy is ever tampered with.