Restrict the REST API to Logged-In Users
Returns an authentication error for REST API requests from visitors who are not logged in, with an allowlist for routes your site needs publicly.
Snippet Library
WordPress code snippets, ready to use
3,040 free snippets from the WPIDE team and the community. Copy the code, or add any snippet to your site in one click with WPIDE.
Secure Checkout Note Above the Pay Button
Reassures shoppers right above the WooCommerce payment button that the connection is encrypted and card details are handled by the payment provider.
Security Headers for wp-admin and the Login Page
Sends nosniff, a strict referrer policy, a restrictive permissions policy and a cross-origin opener policy on dashboard and login pages, which front-end header snippets do not cover.
Send Wordfence Alerts to a Separate Address
Redirects Wordfence's security alert emails to a dedicated address (such as your agency's monitoring inbox) and adds a site tag to the subject, without changing the site admin email.
Serve a security.txt File
Publishes /.well-known/security.txt so security researchers know how to report a vulnerability on your site responsibly.
Shorter Login Sessions for Administrators
Makes administrator logins expire sooner than everyone else's, limiting the damage of a forgotten logged-in browser.
Shorter Nonce Lifetime
Makes WordPress security tokens (nonces) expire after 4 hours instead of up to 24, shrinking the window in which a leaked link can be reused.
Show Your Previous Login Time After Logging In
Greets users in the admin with the date, time and IP address of their previous login, so they can spot logins they do not recognize.
Sign Outgoing Emails With DKIM
Adds a DKIM signature to every email using a private key file and settings stored in wp-config.php, so receiving servers can verify your messages.
Simple Admin Activity Log
Records logins, plugin and theme changes, updates, role changes and deleted content, and lists the last 300 events under Tools > Activity Log.
Simple Math Question on the Login Form
Adds a small addition question to wp-login.php that bots fail, without third-party CAPTCHA services or cookies.
Site Health Check for Must-Have Plugins
Adds a test to Tools > Site Health that turns critical when any plugin you list as essential, such as your backup, security or SEO plugin, is deactivated or missing.
Site Health Check for Security Headers
Adds a Site Health test that loads your homepage and reports which common security headers (HSTS, CSP, nosniff, framing, referrer and permissions policies) are missing.
Site Health Checks for Weak Security Settings
Adds Site Health tests for common weak spots: default or reused security keys, an account named "admin", the file editor left enabled, and a world-readable wp-config.php file.
Skip "Are You Sure You Want to Log Out?" for Menu Links
Adds the security token to My Account log out links placed in your navigation menus, so customers log out in one click instead of seeing a confirmation page.
Slow Down Failed Login Attempts
Waits a second or two before answering a failed login, which makes password-guessing bots far slower without bothering real users.
Strong Password Tip on the MemberPress Sign-Up Form
Adds a short tip about choosing a strong, unique password just above the MemberPress checkout button.
Suspend User Accounts
Adds a "Suspend this account" checkbox to the user edit screen that logs the person out everywhere and blocks them from logging in until it is unticked.
Turn the [acf] Shortcode Back On
Re-enables Advanced Custom Fields' own [acf field="..."] shortcode, which ACF 6.3 switched off by default for security.
Warn About a Public debug.log File
Alerts administrators when WordPress writes errors to wp-content/debug.log, a file anyone can usually download and read.
Warn When There Are Too Many Administrators
Shows a dashboard notice listing the administrator accounts when there are more than you expect, a prompt to downgrade old or unused ones.
Weekly Security Summary Email
Emails the administrator a short security summary every week: pending WordPress, plugin and theme updates, administrator accounts, new users of the week, inactive plugins and whether debug mode is on.