Redirect All Traffic to HTTPS
Permanently redirects every plain HTTP request to the HTTPS version of the same URL, for sites whose host does not do it already.
Snippet Library
WordPress code snippets, ready to use
3,040 free snippets from the WPIDE team and the community. Copy the code, or add any snippet to your site in one click with WPIDE.
Redirect Long-Past Events to the Calendar
Sends visitors (and search engines) from single events that ended more than a set number of days ago to the main events page with a 301 redirect, keeping your calendar fresh.
Redirect Old Date-Based Post URLs
After switching from /2019/05/post-name/ style permalinks to plain post names, sends visitors and search engines from the old dated addresses to the right posts.
Redirect an Empty Cart to the Shop
Sends visitors who open the cart page with nothing in it straight to the shop page instead of showing an empty cart.
Redirect an Old Domain to This Site
Permanently redirects every request that arrives on your previous domain to the same address on your current domain, after a rebrand or domain move.
Redirect to the www or Non-www Version of Your Domain
Sends visitors who arrive on the other version of your domain (with or without www) to the one set as your Site Address, so search engines see a single site.
Register a Custom Image Size
Adds a 600 by 400 cropped image size and makes it selectable in the editor image size dropdown.
Reject Login Attempts That Don't Come From Your Login Form
Refuses login form submissions that are not sent from a page on your own site, which stops many brute-force bots that post straight to wp-login.php.
Reject Registrations From Email Domains That Cannot Receive Mail
Checks that the email domain of every new registration has mail (MX) records, and refuses sign-ups from made-up or mistyped domains that bots and spammers often use.
Reject Requests for Unknown Host Names
Returns an error for requests whose Host header is not your site's domain, which blocks host header injection tricks (such as poisoned password reset links) and junk traffic aimed at your server's IP.
Reject Uploads That Contain PHP Code
Scans every uploaded file that is not a PHP file for hidden PHP code (such as an image with a PHP payload) and refuses the upload if any is found.
Remember Commenters' Details for 30 Days Instead of a Year
Shortens how long the cookies that remember a commenter's name, email and website last, from WordPress's default of one year to 30 days.
Remember UTM Parameters and Fill Hidden Form Fields
Saves utm_source, utm_medium, utm_campaign, utm_term, utm_content and gclid from the landing page in a first-party cookie, then fills matching hidden fields in your forms so leads keep their campaign source.
Remind Authors About Old Drafts
Once a week, emails each author a list of their drafts that have not been touched for a month, with edit links, so good ideas do not get forgotten.
Remind Editors to Add Captions to Videos
Shows a warning after saving when a post contains a Video block without a captions or subtitles track, so videos are not published without captions by accident.
Reminder to Remove Inactive Plugins
Shows administrators a gentle notice on the Dashboard and Plugins screens when plugins have been left inactive, since unused plugins still need updates and can be a security risk.
Remove "Private:" and "Protected:" From Titles
Shows private and password-protected posts with their plain title, without the prefix WordPress adds.
Remove "WordPress" From Admin Page Titles
Shortens browser tab titles in the admin and on the login page by dropping the trailing "— WordPress".
Remove Ad Click IDs From Links in Your Content
Strips tracking parameters such as fbclid, gclid, msclkid and Mailchimp or HubSpot IDs from links in your posts (often pasted in by accident), so you do not pass your visitors' ad tracking along to other sites.
Remove Category, Tag and Author Feed Links From the Head
Stops WordPress from advertising separate feeds for every category, tag, author, search and archive page, while keeping your main feed link.
Remove Completed Privacy Requests After 90 Days
Deletes finished export and erasure requests (and failed ones) from Tools > Export/Erase Personal Data once they are 90 days old, since the request records themselves contain email addresses.
Remove Expired Login Sessions From the Database
Once a day, removes expired login sessions that WordPress keeps in user meta until the user logs in again, which on membership sites and shops adds up to a lot of dead data.
Remove IP Addresses From Comment Notification Emails
Strips commenters' IP addresses and host names from the new comment and moderation emails WordPress sends to authors and administrators, so personal data does not pile up in inboxes.
Remove Links From Comment Author Names
Shows commenter names as plain text instead of links to their websites, removing the main reward for comment spammers.