Ban IPs That Try Common Attack Usernames
Blocks an IP address from logging in for a day as soon as it tries a username like "admin" or "test" that does not exist on your site.
Snippet Library
WordPress code snippets, ready to use
3,040 free snippets from the WPIDE team and the community. Copy the code, or add any snippet to your site in one click with WPIDE.
Block Bad Bots by User Agent
Returns 403 Forbidden to aggressive SEO crawlers and scrapers that waste server resources, matched by their user agent.
Block Checkout for Listed Emails and Phone Numbers
Stops orders from customers on your block list, such as repeat chargeback offenders, matched by email address, email domain or phone number.
Block Common and Guessable Passwords
Rejects the most common passwords, and passwords containing the username or site name, when users set or reset their password.
Block Fake Googlebot Visits
Checks visitors that claim to be Googlebot with a reverse DNS lookup and blocks the impostors, which are usually scrapers or vulnerability scanners.
Block IP Addresses and Ranges
Denies access to the whole site for the IP addresses and IPv4 ranges you list, for example a persistent spammer or attacker.
Block Logins From Accounts Without a Role
Stops accounts that have no role on this site (often left over after a role was removed) from logging in, which closes a common gap on older sites.
Block Malicious Request Patterns
A tiny firewall that returns 403 Forbidden for URLs containing typical attack strings, such as directory traversal, SQL injection and PHP stream wrappers.
Block Password Resets for Administrators
Disables the "Lost your password?" flow for administrator accounts, which closes off reset-email based takeovers of the most powerful accounts.
Block Reserved Usernames
Prevents anyone from registering or being created with usernames like admin, support or root that look official or invite attacks.
Content Security Policy Builder With Violation Reports
Sends a report-only Content Security Policy and collects the browser's violation reports, then lists every blocked source per directive under Tools > CSP Reports with a suggested policy you can enforce later.
Content Security Policy Header (Report-Only)
Sends a starter Content Security Policy in report-only mode, so you can see in the browser console what a strict policy would block before enforcing it.
Daily Core File Integrity Check
Compares your WordPress core files with the official checksums once a day and emails the administrator if any file was changed or is missing.
Default Upload Limits for Contact Form 7 File Fields
Gives every Contact Form 7 file field a safe default list of allowed file types and a maximum size, unless the field already sets its own.
Default Upload Limits for Gravity Forms File Fields
Gives every Gravity Forms file upload field a safe list of allowed file types and a maximum file size when the field does not set its own.
Default Upload Limits for WPForms File Fields
Gives every WPForms file upload field a safe list of allowed file types and a maximum size when the field does not set its own.
Disable Application Passwords
Removes the Application Passwords feature, which lets external apps authenticate to the REST API. Disable it if you do not use it.
Disable Password Resets for Everyone
Turns off the "Lost your password?" feature for all users, for sites where accounts are managed only by an administrator.
Disable Plugin and Theme Auto-Updates
Prevents plugins and themes from updating automatically and hides the auto-update toggles. Core security releases keep installing.
Disable XML-RPC Multicall
Removes the XML-RPC system.multicall method, which attackers use to try hundreds of passwords in a single request, while XML-RPC keeps working for apps and Jetpack.
Email Alert When Key Site Settings Change
Emails the site admin when important settings change, such as the site address, admin email, open registration or the default role for new users, a common sign of a hacked site.
Email Alert When Plugins Are Activated or Deactivated
Emails the site administrator whenever a plugin is turned on or off, with who did it and when.
Email Alert When Super Admin Rights Change
Emails the network admin address whenever someone is granted or loses super admin rights, with who made the change.
Email Alert When a New Administrator Appears
Emails the site owner whenever an account is created as, or promoted to, administrator, which is often the first sign of a compromise.