Disable XML-RPC Multicall
Removes the XML-RPC system.multicall method, which attackers use to try hundreds of passwords in a single request, while XML-RPC keeps working for apps and Jetpack.
Snippet Library
Security snippets for WordPress
Snippets that harden WordPress: turn off XML-RPC, hide the version number, stop user enumeration, add security headers and block risky uploads. Small, reviewable changes for site owners who want fewer attack points without a heavy security plugin.
Email Alert When Plugins Are Activated or Deactivated
Emails the site administrator whenever a plugin is turned on or off, with who did it and when.
Email Alert When a New Administrator Appears
Emails the site owner whenever an account is created as, or promoted to, administrator, which is often the first sign of a compromise.
Email Alert When an Administrator Logs In
Sends an email to the site admin address every time an administrator account logs in, with the time, IP address and browser.
Enable HTTP Strict Transport Security (HSTS)
Tells browsers to always use HTTPS for your domain for one year. Only enable it once the whole site, including subdomains you use, works over HTTPS.
End Admin Sessions When the IP Address Changes
Logs an administrator out if their session suddenly comes from a different IP address than the one they logged in from, which blocks stolen cookies.
Hide Email Addresses From Spam Bots
Encodes every email address and mailto link in posts, widgets and comments so people see them normally but simple harvesting bots cannot read them.
Hide PHP Errors From Visitors
Turns off on-screen PHP warnings and errors for everyone except logged-in administrators, so file paths are never shown to the public.
Hide Whether an Account Exists on Password Reset
Shows the same "check your email" screen for unknown usernames and emails on the lost password form, so it cannot be used to find valid accounts.
Hide the REST API Index From Visitors
Stops logged-out visitors from listing every REST API route and plugin namespace at /wp-json/, while the routes themselves keep working.
Honeypot Trap for Login and Registration Forms
Adds an invisible field to the login and registration forms; bots that fill it in are rejected while people never see it.
Limit Password Reset Requests
Allows only a few password reset requests per hour from the same IP address, which stops reset-email flooding.
Lock Registration and Default Role Settings
Forces "Anyone can register" and the default new user role to fixed values in code, so an attacker or a mistake cannot open admin-level sign-ups.
Lock the Site URL and Admin Email
Ignores changes to the WordPress Address, Site Address and administration email made from the dashboard, a common target after an account takeover.
Log Failed Logins
Keeps a log of the last 200 failed login attempts with username, IP address and time, viewable under Tools > Failed Logins.
Nonce-Based Content Security Policy for Scripts
Adds a fresh random nonce to every script WordPress prints and sends a strict, nonce-based script policy (report-only by default), the modern way to block injected scripts.
Prevent Deactivating Essential Plugins
Removes the Deactivate option for the plugins you list, for every user, so key functionality cannot be switched off by accident.
Protect wp-login.php With a Secret Key
Hides the login page behind a secret link: wp-login.php returns "Not Found" unless you have opened it with your key once in this browser.
Rate-Limit the REST API for Visitors
Limits how many REST API requests a logged-out visitor can make per minute and answers "429 Too Many Requests" beyond that, slowing scrapers and scanners.
Redirect All Traffic to HTTPS
Permanently redirects every plain HTTP request to the HTTPS version of the same URL, for sites whose host does not do it already.
Redirect wp-admin to the Homepage for Logged-Out Visitors
Sends logged-out visitors who open /wp-admin/ to the homepage instead of the login page, so bots probing wp-admin do not learn where to log in.
Remind Administrators to Change Old Passwords
Shows administrators a reminder when they have not changed their password for 180 days.
Remove Usernames From CSS Classes
Strips the author and commenter usernames WordPress adds to body and comment classes, closing a quiet way to discover login names.
Require Strong Passwords for Editors and Administrators
Requires at least 12 characters with letters, numbers and a symbol or mixed case for users who can edit other people's content.