Email Alert When a User's Role Changes
Emails the site administrator whenever a user's role changes, which helps spot unexpected privilege changes.
Snippet Library
WordPress code snippets, ready to use
3,040 free snippets from the WPIDE team and the community. Copy the code, or add any snippet to your site in one click with WPIDE.
Email Alert When an Administrator Logs In
Sends an email to the site admin address every time an administrator account logs in, with the time, IP address and browser.
Email Users When They Log In From a New Device
Sends members an email when their account is used from a browser and network it has not seen before, so they can react quickly if it was not them.
Emailed Login Code for Staff Accounts
Adds a second step for administrators and editors: after the correct password, WordPress emails a 6-digit code that must be entered to finish logging in.
Enable HTTP Strict Transport Security (HSTS)
Tells browsers to always use HTTPS for your domain for one year. Only enable it once the whole site, including subdomains you use, works over HTTPS.
End Admin Sessions When the IP Address Changes
Logs an administrator out if their session suddenly comes from a different IP address than the one they logged in from, which blocks stolen cookies.
Expire Passwords After 90 Days
Makes users in chosen roles reset their password once it is older than 90 days; at login they are told it has expired and pointed to the password reset form.
Force HTTPS on the Front End
Sends visitors who open a page over plain HTTP to the secure HTTPS address with a permanent redirect, once your site URL is set to https.
Hide Email Addresses From Spam Bots
Encodes every email address and mailto link in posts, widgets and comments so people see them normally but simple harvesting bots cannot read them.
Hide PHP Errors From Visitors
Turns off on-screen PHP warnings and errors for everyone except logged-in administrators, so file paths are never shown to the public.
Hide Whether an Account Exists on Password Reset
Shows the same "check your email" screen for unknown usernames and emails on the lost password form, so it cannot be used to find valid accounts.
Hide the "Remember Me" Checkbox
Removes the Remember Me option so every login ends when the browser closes, which suits shared or public computers.
Hide the Administrator Role From Non-Administrators
Removes Administrator from the role dropdowns for anyone who is not an administrator, so delegated user managers cannot promote themselves or others.
Hide the REST API Index From Visitors
Stops logged-out visitors from listing every REST API route and plugin namespace at /wp-json/, while the routes themselves keep working.
Honeypot Trap for Login and Registration Forms
Adds an invisible field to the login and registration forms; bots that fill it in are rejected while people never see it.
Hourly Limit on Outgoing Emails
Caps how many emails the site can send per hour and stops the rest, which protects your mail account and domain reputation if a form or plugin is abused to send spam.
Limit Password Reset Requests
Allows only a few password reset requests per hour from the same IP address, which stops reset-email flooding.
Limit REST API CORS to Your Own Apps
Replaces WordPress's permissive cross-origin (CORS) headers with an allow-list, so only the browser apps you name, such as a headless front end, can call the REST API with credentials.
Limit Sign-Ups per IP Address
Allows only a few new accounts per IP address per day, which stops bots and people from creating piles of accounts.
Limit the Number of Recipients per Email
Refuses to send any single email to more than a set number of recipients across To, CC and BCC, which stops a compromised form or plugin from blasting your contacts.
Lock Accounts That Haven't Been Used for Months
Blocks logins from accounts that have been inactive for a long time (180 days by default) until they reset their password, which protects forgotten accounts.
Lock Registration and Default Role Settings
Forces "Anyone can register" and the default new user role to fixed values in code, so an attacker or a mistake cannot open admin-level sign-ups.
Lock the List of Super Admins
Blocks anyone from being granted super admin rights unless their username is on your approved list, protecting the network if a super admin account is compromised.
Lock the Site URL and Admin Email
Ignores changes to the WordPress Address, Site Address and administration email made from the dashboard, a common target after an account takeover.