Log Failed Logins
Keeps a log of the last 200 failed login attempts with username, IP address and time, viewable under Tools > Failed Logins.
Snippet Library
WordPress code snippets, ready to use
3,040 free snippets from the WPIDE team and the community. Copy the code, or add any snippet to your site in one click with WPIDE.
Log Out Idle Users Automatically
Logs users out after a set time without any mouse, keyboard or scroll activity, counted across all their open tabs.
Log Users Out Everywhere When Their Role Changes
Ends all of a user's active sessions as soon as an administrator changes or removes their role, so a demoted account cannot keep using old access.
Make New Users Change Their Password on First Login
When an administrator creates an account, the new user is sent to their profile and asked to choose a new password before they can use the rest of the site.
Nonce-Based Content Security Policy for Scripts
Adds a fresh random nonce to every script WordPress prints and sends a strict, nonce-based script policy (report-only by default), the modern way to block injected scripts.
Password Reset by Email Address Only
Makes the "Lost your password?" form accept only an email address, not a username, so the form can't be used to probe which usernames exist.
Prevent Deactivating Essential Plugins
Removes the Deactivate option for the plugins you list, for every user, so key functionality cannot be switched off by accident.
Protect Specific Users From Editing and Deletion
Stops anyone but the users themselves from editing, demoting or deleting the accounts you list, such as the site owner or an agency account.
Protect wp-login.php With a Secret Key
Hides the login page behind a secret link: wp-login.php returns "Not Found" unless you have opened it with your key once in this browser.
Rate Limit the Store API Against Card Testing
Turns on WooCommerce's built-in rate limiting for the Store API used by the block cart and checkout, slowing down bots that test stolen cards.
Rate-Limit Site Searches
Limits how many searches one visitor can run per minute and answers the rest with "429 Too Many Requests", protecting your database from search floods.
Rate-Limit the REST API for Visitors
Limits how many REST API requests a logged-out visitor can make per minute and answers "429 Too Many Requests" beyond that, slowing scrapers and scanners.
Recent Login History on the Profile Screen
Records the last 10 logins for each user (time, IP address and browser) and lists them on their profile screen so they can spot logins they do not recognise.
Redirect All Traffic to HTTPS
Permanently redirects every plain HTTP request to the HTTPS version of the same URL, for sites whose host does not do it already.
Redirect wp-admin to the Homepage for Logged-Out Visitors
Sends logged-out visitors who open /wp-admin/ to the homepage instead of the login page, so bots probing wp-admin do not learn where to log in.
Reject Login Attempts for Common Usernames
Refuses login attempts for usernames bots love to try, such as "admin", "administrator" or "root", before WordPress even checks a password.
Remind Administrators to Change Old Passwords
Shows administrators a reminder when they have not changed their password for 180 days.
Reminder to Remove Inactive Plugins
Shows administrators a gentle notice on the Dashboard and Plugins screens when plugins have been left inactive, since unused plugins still need updates and can be a security risk.
Remove Usernames From CSS Classes
Strips the author and commenter usernames WordPress adds to body and comment classes, closing a quiet way to discover login names.
Remove the WooCommerce Version Meta Tag
Stops WooCommerce adding its version number to your page source, so bots scanning for outdated stores learn a little less.
Remove the X-Mailer Header From Emails
Stops outgoing emails announcing "PHPMailer" and its version in the X-Mailer header, which reveals details about your server and can count against you in spam filters.
Require Strong Passwords for Editors and Administrators
Requires at least 12 characters with letters, numbers and a symbol or mixed case for users who can edit other people's content.
Require Unique Display Names
Stops users from picking a public display name that another member already uses, which prevents impersonation in comments and forums.
Require a Minimum Password Length
Rejects new passwords shorter than 12 characters on the profile screen, the Add New User screen and the password reset form.