Security

Make the Wordpress REST API more Secure by only allowing certain REST Endpoints for logged-out users

Detect and block disposable or temporary email addresses in comments, registrations, and contact forms — with full GDPR/CCPA-compliant logging and developer hooks, for WordPress

Removes sections of thumb path within attachment metadata when updated, if path attempts to access another directory.

Customize your login URL slug and block default login routes if enabled.

Powerful Recaptcha For WordPress & Woocommerce

yuz-otp : passerelle de vérification OTP via Twilio Verify.

Disable XMLRPC Completely. Also, allow Updates on Git-Controlled Websites

A set of encryption/decryption functions based on Laravel Encryption class.

Easily add Google reCAPTCHA v3 to WooCommerce CheckOut page and forms to prevent spam.

Comprehensive security hardening for WordPress - addresses user enumeration, version disclosure, and other vulnerabilities

WordPress plugin: shows which copy of a site you're on, holds emails on staging and local copies, and keeps them out of search engines.

Mason WordPress plugin which implements improvements to the WordPress login page.

Wordpress doesn't verify file extensions when media is uploaded. This plugin will detect the filetype and append the correct extension if it is not present.

mu-plugins

WordPress 2FA Plugin

EmailSherlock Email Guard: block disposable and undeliverable email addresses at form submit in WordPress (comments, registration, WooCommerce, Contact Form 7, WPForms, Gravity Forms).

This plugin integrates Google's reCAPTCHA to the default WordPress Registration system.

autologin-from-hashkey is the wordpress plugin

This plugin integrates Google's reCAPTCHA to the default WordPress Login system.

Mason WordPress plugin which implements central authentication.

Keep spam registrations out without a captcha

Professional malware detection and safe auto-repair for WordPress, built for speed and trust on shared hosting.

WordPress plugin that simply puts recaptcha on the WordPress registration page.

Disables the comment submit button for 30 seconds after page load, providing a very simple layer of spam protection with no bloat (1 line of JavaScript)

PoC reCAPTCHA ~ personal use

Uses OpenRouter LLM to classify and flag spam comments automatically.

Core security, performance, and widget visibility MU-plugin for pausatf.org

A security-hardened WordPress debug log viewer. View, search, and manage wp-content/debug.log from the admin dashboard with Debug Bar integration.