Limit Sign-Ups per IP Address
Allows only a few new accounts per IP address per day, which stops bots and people from creating piles of accounts.
Snippet Library
WordPress code snippets, ready to use
3,040 free snippets from the WPIDE team and the community. Copy the code, or add any snippet to your site in one click with WPIDE.
Noindex Page 2 and Beyond With Yoast
Tells search engines not to index paginated archive pages (page 2, 3 and so on) while still following their links, using Yoast SEO's robots meta.
Noindex Paginated Archives With All in One SEO
Adds noindex to page 2 and later of archives through All in One SEO's robots meta while keeping links followed.
Noindex Paginated Archives With Rank Math
Sets page 2 and later of archives to noindex, follow through Rank Math's robots meta, keeping the first page indexable.
Noindex Posts in Selected Categories
Keeps posts from the categories you choose, such as internal news or short announcements, out of search engine results.
Noindex Search Result Pages
Asks search engines not to index your internal search result pages, which are thin, endless and a favorite target for spam links.
Noindex Selected Posts and Pages
Asks search engines not to index the posts and pages you list, such as thank-you, login or internal pages, while still following their links.
Noindex Staging and Development Sites
Adds noindex, nofollow to every page when WP_ENVIRONMENT_TYPE is not production, so staging copies never end up in search results.
Noindex Subsites With a Staging Path
Adds a noindex robots directive to any subsite whose address contains "staging", "dev" or "test", so preview copies inside a network never show up in search results.
Noindex Thin Archive Pages
Adds noindex, follow to date archives, attachment pages and page 2+ of archives, so search engines focus on your real content.
Rate Limit the Store API Against Card Testing
Turns on WooCommerce's built-in rate limiting for the Store API used by the block cart and checkout, slowing down bots that test stolen cards.
Redirect wp-admin to the Homepage for Logged-Out Visitors
Sends logged-out visitors who open /wp-admin/ to the homepage instead of the login page, so bots probing wp-admin do not learn where to log in.
Reject Comments Submitted Too Fast
Rejects comments sent within a few seconds of the page loading, which only bots manage, using a signed timestamp in the form.
Reject Contact Form 7 Submissions Sent Too Fast
Stamps each Contact Form 7 form with a signed time when it is shown and treats submissions sent within a few seconds as spam. People take longer than bots to fill in a form.
Reject Gravity Forms Submitted Too Quickly
Adds a signed time stamp to each Gravity Forms form and marks entries sent within a few seconds of the page loading as spam, which catches bots that fill forms instantly.
Reject Login Attempts That Don't Come From Your Login Form
Refuses login form submissions that are not sent from a page on your own site, which stops many brute-force bots that post straight to wp-login.php.
Reject Login Attempts for Common Usernames
Refuses login attempts for usernames bots love to try, such as "admin", "administrator" or "root", before WordPress even checks a password.
Reject Registrations From Email Domains That Cannot Receive Mail
Checks that the email domain of every new registration has mail (MX) records, and refuses sign-ups from made-up or mistyped domains that bots and spammers often use.
Reject Registrations Submitted Too Fast
Stamps the WordPress registration form with a signed time and refuses sign-ups sent within a few seconds of loading it, which stops most registration bots.
Remove the WooCommerce Version Meta Tag
Stops WooCommerce adding its version number to your page source, so bots scanning for outdated stores learn a little less.
Send Comments With Links in the Name Field to Spam
Marks comments as spam when the name field contains a web address, a classic trick of spam bots.
Simple Math Question on the Login Form
Adds a small addition question to wp-login.php that bots fail, without third-party CAPTCHA services or cookies.
Slow Down Failed Login Attempts
Waits a second or two before answering a failed login, which makes password-guessing bots far slower without bothering real users.
Spam-Protected Email Shortcode
Adds an [email] shortcode that prints a clickable email address encoded so simple spam bots cannot harvest it.