Reject Login Attempts for Common Usernames
Refuses login attempts for usernames bots love to try, such as "admin", "administrator" or "root", before WordPress even checks a password.
Snippet Library
WordPress code snippets, ready to use
3,040 free snippets from the WPIDE team and the community. Copy the code, or add any snippet to your site in one click with WPIDE.
Reject Requests for Unknown Host Names
Returns an error for requests whose Host header is not your site's domain, which blocks host header injection tricks (such as poisoned password reset links) and junk traffic aimed at your server's IP.
Relax the Account Password Strength Requirement
Lowers the password strength WooCommerce requires on registration and checkout from "strong" to "medium", which reduces abandoned sign-ups.
Remind Administrators to Change Old Passwords
Shows administrators a reminder when they have not changed their password for 180 days.
Remove "Private:" and "Protected:" From Titles
Shows private and password-protected posts with their plain title, without the prefix WordPress adds.
Remove "Protected:" and "Private:" From Titles
Drops the "Protected:" and "Private:" words WordPress adds in front of the titles of password-protected and private posts.
Require Strong Passwords for Editors and Administrators
Requires at least 12 characters with letters, numbers and a symbol or mixed case for users who can edit other people's content.
Require a Minimum Password Length
Rejects new passwords shorter than 12 characters on the profile screen, the Add New User screen and the password reset form.
Send Plain WordPress Emails in a Branded HTML Layout
Wraps the plain-text emails WordPress sends (password resets, notifications, form plugins) in a simple HTML layout with your site name and clickable links.
Show/Hide Button on Front-End Password Fields
Adds an accessible "Show" button inside password fields on the front of the site (account, checkout and membership forms), so visitors can check what they typed.
Slow Down Failed Login Attempts
Waits a second or two before answering a failed login, which makes password-guessing bots far slower without bothering real users.
Stop Password Reset Notifications to the Admin
Stops the email the site admin gets each time a user resets their password.
Stop Password and Email Change Confirmations
Stops WordPress from emailing users when their password or email address is changed, for example during bulk imports.
Strong Password Tip on the MemberPress Sign-Up Form
Adds a short tip about choosing a strong, unique password just above the MemberPress checkout button.
Turn Off Autofocus on the Login Form
Stops the login, lost password and registration screens from putting the cursor in the first field as soon as they load, so the page does not jump or pop up the on-screen keyboard.
Turn Off the Login Form Shake
Stops the login box from shaking after a wrong password, for a calmer login screen.
Write SMTP Conversation to the Debug Log
Records the conversation between WordPress and your SMTP server in the PHP error log while you troubleshoot, with passwords and login tokens blanked out.