Snippet Library
Snippets that harden WordPress: turn off XML-RPC, hide the version number, stop user enumeration, add security headers and block risky uploads. Small, reviewable changes for site owners who want fewer attack points without a heavy security plugin.
Keeps a list of approved administrator accounts and checks it daily and on every dashboard visit; administrators that appear any other way (for example inserted directly into the database by malware) trigger an email and a warning with an approve button.
Removes the Application Passwords feature, which lets external apps authenticate to the REST API. Disable it if you do not use it.
Removes the XML-RPC system.multicall method, which attackers use to try hundreds of passwords in a single request, while XML-RPC keeps working for apps and Jetpack.
Emails the site administrator whenever a plugin is turned on or off, with who did it and when.
Emails the site owner whenever an account is created as, or promoted to, administrator, which is often the first sign of a compromise.
Sends an email to the site admin address every time an administrator account logs in, with the time, IP address and browser.
Emails the user and the site administrator whenever a new application password is created for an account, since these passwords give API access that bypasses the normal login.
Adds a "Lockdown" toggle to the admin bar for administrators. While it is on, only administrators can log in, everyone else is logged out, registration and comments are closed and XML-RPC is off.
Tells browsers to always use HTTPS for your domain for one year. Only enable it once the whole site, including subdomains you use, works over HTTPS.
Logs an administrator out if their session suddenly comes from a different IP address than the one they logged in from, which blocks stolen cookies.
Makes the cookie that remembers a protected post's password last only until the browser is closed, instead of the default 10 days, which matters on shared and public computers.
Encodes every email address and mailto link in posts, widgets and comments so people see them normally but simple harvesting bots cannot read them.
Turns off on-screen PHP warnings and errors for everyone except logged-in administrators, so file paths are never shown to the public.
Replaces the ?ver= value on plugin and theme CSS and JavaScript files with a short hash, so scanners cannot read your exact plugin versions from the page source, while caches still refresh whenever a version changes.
Shows the same "check your email" screen for unknown usernames and emails on the lost password form, so it cannot be used to find valid accounts.
Stops logged-out visitors from listing every REST API route and plugin namespace at /wp-json/, while the routes themselves keep working.
Blocks the REST API users endpoint for logged-in users who cannot edit posts, such as subscribers and shop customers, so a low-level account cannot list your authors and their usernames.
Adds an invisible field to the login and registration forms; bots that fill it in are rejected while people never see it.
Adds a hidden field to the lost password form that only bots fill in and silently ignores those requests, so bots cannot flood your users with reset emails.
Adds a hidden field to the comment form that only a real browser running JavaScript fills in; comments without it go to the spam queue instead of moderation.
Allows each visitor at most 10 password attempts on password-protected posts and pages every 15 minutes, which stops bots from brute-forcing the post password.
Caps uploads at 30 files per hour for each user who is not an administrator, which limits the damage a compromised author account or a buggy front-end upload form can do.
Allows only a few password reset requests per hour from the same IP address, which stops reset-email flooding.
Forces "Anyone can register" and the default new user role to fixed values in code, so an attacker or a mistake cannot open admin-level sign-ups.