Keep a clear record of important dashboard activity—who logged in, what changed, and when—so you can investigate issues or stay audit-ready without digging through server logs.

Remove the dashboard screens that let anyone edit theme or plugin code from the browser—one less disaster if an account is compromised.

Block anonymous access to WordPress core REST endpoints (users, settings, themes, and similar) while leaving logged-in staff and third-party plugin REST routes untouched.

Disables WordPress application passwords site-wide: blocks REST/XML-RPC login with app tokens and hides the profile UI. Normal account passwords and logged-in REST access are unaffected. Existing tokens remain stored but cannot authenticate until this module is off. May break mobile apps, headless sites, and automation that rely on application passwords.

Closes the old XML-RPC channel many password-guessing tools still target. Fine for most sites; skip if you rely on legacy apps or remote publishing that need it.

Tell modern browsers to enforce sensible safety rules—like blocking sneaky scripts and iframe tricks—with strong defaults you can tighten further for HSTS or content policies.

Slow down password-guessing bots by locking out repeated failed logins for increasing cool-off periods—simple protection for your sign-in form.

Turn off public "forgot password" self-service for everyone. Use only when you reset passwords another way (manual admin password, WP-CLI, or admin-sent reset links when enabled in settings). Existing email reset links stop working while this module is on.

Two-factor login for selected roles—extra proof beyond the password.

Stops old-style trackbacks and pingbacks that often bring spam or junk alerts.

Put your whole site behind one shared password—ideal for staging, client previews, or a soft launch before you go public.

Blocks risky default usernames during registration so bots have fewer easy targets.

Always open your dashboard and login screen over a secure https:// link. Anyone using the old http:// address is sent to the encrypted URL automatically.

Removes WordPress version from public HTML generator tags, feed generator output, and the admin footer. Does not change ver= on script and style URLs.

Bot protection with Cloudflare Turnstile on logins, forms, comments, and WooCommerce—low hassle for real people.

Google reCAPTCHA on logins, forms, comments, and WooCommerce to block bots and spam signups.

Ask a quick math question, custom prompt, or image check before someone can submit a form or log in. Everything runs on your server—no third-party CAPTCHA account required.

Allow or block visitors by IP address—ideal for office-only dashboards or shutting out known troublemakers. Rules apply site-wide, including wp-admin and login.

Automatically protects visible email addresses and mailto links from basic spam bots by safely encoding them while keeping them clickable for visitors.