Personal Data Request Form Shortcode
Adds a [privacy_request_form] shortcode where visitors can ask for a copy of their personal data or for its deletion. Requests go into WordPress's own privacy tools and the visitor confirms by email.
Snippet Library
WordPress code snippets, ready to use
3,040 free snippets from the WPIDE team and the community. Copy the code, or add any snippet to your site in one click with WPIDE.
Protect wp-cron.php From Outside Requests
Requires a secret key for requests to wp-cron.php and adds that key automatically to WordPress's own cron calls, so outsiders cannot hammer the endpoint to slow your site down.
Quote Request Form Shortcode
Adds a [wpide_quote_form] shortcode where visitors pick a service, budget and timeline and describe their project; requests are emailed to you with spam protection and rate limiting built in.
REST API Error Log Under Tools
Records REST API requests that fail with a 4xx or 5xx status, with the route, method, user and error code, and lists the latest 100 under Tools > REST Errors for debugging integrations.
Raise the REST API per_page Limit
Lets REST API requests for posts and pages ask for more than 100 items at once, useful for exports and static site generators.
Rate-Limit Site Searches
Limits how many searches one visitor can run per minute and answers the rest with "429 Too Many Requests", protecting your database from search floods.
Rate-Limit the REST API for Visitors
Limits how many REST API requests a logged-out visitor can make per minute and answers "429 Too Many Requests" beyond that, slowing scrapers and scanners.
Redirect Missing Resized Images to the Original
Sends requests for resized images that no longer exist, such as photo-300x200.jpg after a theme change, to the original upload, fixing broken images in old posts and on other sites.
Reject Requests for Unknown Host Names
Returns an error for requests whose Host header is not your site's domain, which blocks host header injection tricks (such as poisoned password reset links) and junk traffic aimed at your server's IP.
Remove Completed Privacy Requests After 90 Days
Deletes finished export and erasure requests (and failed ones) from Tools > Export/Erase Personal Data once they are 90 days old, since the request records themselves contain email addresses.
Restrict the REST API to Logged-In Users
Returns an authentication error for REST API requests from visitors who are not logged in, with an allowlist for routes your site needs publicly.
Return 410 Gone for Removed Pages
Answers requests for pages you deleted on purpose with a "410 Gone" status instead of a 404, so search engines drop them from results faster.
Show Outgoing HTTP Requests in the Admin Bar
Counts the external HTTP requests WordPress, plugins and themes make while building a page, and lists each URL, status and time in an admin bar menu for administrators.
Site Health Check for Compression and Browser Caching
Adds a Site Health test that requests your homepage and one of your theme's stylesheets and reports whether text files are compressed (gzip or Brotli) and whether static files get long browser cache lifetimes.
Skip Slow Site Health Tests
Removes the Site Health checks that make HTTP requests back to your own site, which are slow or time out on some hosts.
Spawn WP-Cron Less Often
Lets WordPress start its background task runner at most every five minutes instead of every minute, reducing extra requests on busy sites.
Stop "Data Request Confirmed" Emails to the Admin
Stops WordPress emailing the site admin each time a user confirms a personal data export or erasure request; you can still see requests under Tools.
Stop Bricks From Loading Google Fonts
Turns on Bricks' "Disable Google Fonts" setting from code, so neither the builder nor the front end requests fonts from Google.
Stop Divi From Loading Google Fonts
Turns off Divi's Google Fonts option and removes the default Open Sans stylesheet, so no font requests go to Google from your Divi site.
Stop Elementor Icon Fonts Loading for Visitors
Removes the Font Awesome and Elementor icon font stylesheets from the front end for visitors, which saves several requests on sites that use SVG icons or no icons at all.
Third-Party Requests Inspector in the Admin Bar
Adds an admin bar item on the front of the site that counts the external domains the current page loads files from, and lists them on click, to help you keep your cookie notice and privacy policy accurate.
Turn Off Autosave for Chosen Post Types
Stops the editor from autosaving the post types you list (for example products or custom data types edited by many people), which removes frequent background requests and extra autosave revisions.
Turn Off Avatars Everywhere
Stops avatars from being shown in comments, the admin bar and user lists, saving the image requests.
Turn Off Avatars in the Dashboard Only
Stops wp-admin from loading an avatar for every row of the comments and users screens and the dashboard, which saves dozens of requests to Gravatar, while avatars keep showing on the front of the site.