Restrict the REST API to Logged-In Users
Returns an authentication error for REST API requests from visitors who are not logged in, with an allowlist for routes your site needs publicly.
Snippet Library
Security snippets for WordPress
Snippets that harden WordPress: turn off XML-RPC, hide the version number, stop user enumeration, add security headers and block risky uploads. Small, reviewable changes for site owners who want fewer attack points without a heavy security plugin.
Secure Checkout Note Above the Pay Button
Reassures shoppers right above the WooCommerce payment button that the connection is encrypted and card details are handled by the payment provider.
Security Headers for wp-admin and the Login Page
Sends nosniff, a strict referrer policy, a restrictive permissions policy and a cross-origin opener policy on dashboard and login pages, which front-end header snippets do not cover.
Serve a security.txt File
Publishes /.well-known/security.txt so security researchers know how to report a vulnerability on your site responsibly.
Shorter Nonce Lifetime
Makes WordPress security tokens (nonces) expire after 4 hours instead of up to 24, shrinking the window in which a leaked link can be reused.
Simple Admin Activity Log
Records logins, plugin and theme changes, updates, role changes and deleted content, and lists the last 300 events under Tools > Activity Log.
Simple Math Question on the Login Form
Adds a small addition question to wp-login.php that bots fail, without third-party CAPTCHA services or cookies.
Site Health Check for Security Headers
Adds a Site Health test that loads your homepage and reports which common security headers (HSTS, CSP, nosniff, framing, referrer and permissions policies) are missing.
Site Health Checks for Weak Security Settings
Adds Site Health tests for common weak spots: default or reused security keys, an account named "admin", the file editor left enabled, and a world-readable wp-config.php file.
Slow Down Failed Login Attempts
Waits a second or two before answering a failed login, which makes password-guessing bots far slower without bothering real users.
Strong Password Tip on the MemberPress Sign-Up Form
Adds a short tip about choosing a strong, unique password just above the MemberPress checkout button.
Warn About a Public debug.log File
Alerts administrators when WordPress writes errors to wp-content/debug.log, a file anyone can usually download and read.
Warn When There Are Too Many Administrators
Shows a dashboard notice listing the administrator accounts when there are more than you expect, a prompt to downgrade old or unused ones.
Weekly Security Summary Email
Emails the administrator a short security summary every week: pending WordPress, plugin and theme updates, administrator accounts, new users of the week, inactive plugins and whether debug mode is on.