Security snippets
Close the doors attackers try first and hide what they look for. Free, tested and ready to install in Snipfire in one click.
- 256 snippets
- 29 one-click packs
- Tested with WordPress 7.1 and WooCommerce 11.1
- No account needed
- Turn off XML-RPC Blocks remote publishing, pingbacks and password guessing through xmlrpc.php. The block editor, the REST API and the WordPress apps don’t need it.
- Turn off application passwords Removes application passwords (logins for apps and scripts through the REST API) if you don’t use them.
- Turn off the theme and plugin file editors Removes the code editors under Appearance and Plugins, so a stolen admin login can’t be used to write PHP into your theme or plugin files.
- Send visitors to the HTTPS address Visitors who open a page over plain http are redirected to the same page on https. Only runs on the live site (production), so local copies keep working.
- One message for every failed login The login form says “Wrong username or password” instead of telling a stranger whether a user name exists.
- Hide the WordPress version Removes the version number from the page head and feeds, and from the addresses of WordPress’s own scripts and styles.
- Spam trap in the registration form Adds a hidden field to the wp-login.php registration form that bots fill in and people never see. Those registrations are refused.
- Don’t announce the PHP version Removes the X-Powered-By header that tells every visitor (and every scanner) which PHP version the server runs.
- Add security headers Sends headers that stop other sites from framing your pages, stop browsers from guessing file types, keep full page addresses private when visitors follow links, and turn off camera, microphone and location access.
- Stop visitors from listing user names Closes the usual ways to find your user names: ?author=1 links, the public users list in the REST API and the users sitemap. Logged-in editors still see authors as usual.
No snippet matches that yet. Tell us what you need and we'll consider adding it. Suggest a snippet
Or install a whole pack
Packs group snippets that belong together. Open one in Snipfire, tick what you want and install: everything arrives switched off, or switched on together after one test load. Snippets that need your details, or that change how the whole site behaves, always stay off until you say so.
- Harden WordPress Close the doors attackers try first: XML-RPC, user name discovery, the file editors, revealing login errors. 7 snippets
- Clean up the head Remove the links, scripts and styles WordPress adds to every page that most sites never use. 7 snippets
- Performance Small changes that save the server and the browser some work. 7 snippets
- Turn off what you don’t use Each of these replaces a small plugin: no comments, classic editor, no feeds, no search and more. 9 snippets
- Admin and login Your branding on the login page, a tidier admin, and handy extras such as duplicating posts. 8 snippets
- Content and media Shortcodes, links, images and small design touches for the public site. 10 snippets
- WooCommerce essentials The small WooCommerce changes shop owners ask for most. 11 snippets
- Greek e-shop For shops in Greece: receipt or invoice with a checked VAT number (ΑΦΜ), Greek phone and postcode checks, a cash on delivery fee, and greeklish addresses. 6 snippets
- Privacy and GDPR Keep less personal data and send less of it to other companies. 4 snippets
- Analytics and pixels The usual tracking codes, ready to paste your ID into. Administrators’ visits aren’t counted. 6 snippets
- Comments Fewer spam comments and more control: close old posts, set minimum and maximum lengths, a spam trap, no links. 13 snippets
- Posts and the editor Make the block editor calmer and give pages excerpts, tags and categories. 14 snippets
- Images and media Sharper, lighter images, tidier uploads and a more useful media library. 11 snippets
- More admin tweaks Useful columns, a tidier admin bar, a welcome box for clients, and fewer menus for editors. 15 snippets
- Users and profiles Registration dates, last logins, social profile fields, longer sessions and stricter passwords. 9 snippets
- Login and security extras Limit login attempts, email-only logins, a registration spam trap and more hardening. 11 snippets
- Email Emails from your name and address, sent through SMTP, and fewer notification emails. 8 snippets
- SEO basics Meta descriptions, social sharing tags, article structured data and cleaner indexing, for sites without an SEO plugin. 11 snippets
- RSS feeds Control what your RSS feed shows, and when. 7 snippets
- Search and archives Better site search and cleaner archive pages. 6 snippets
- Design touches Small front-end touches: a reading progress bar, an announcement bar, a WhatsApp button, accessibility fixes. 11 snippets
- Shortcodes Handy shortcodes for dates, breadcrumbs, buttons, share links, members-only content and more. 12 snippets
- More speed More ways to load less: block styles, speculative loading, fewer scripts. 9 snippets
- Turn off more More features you may not need: sitemaps, trackbacks, automatic updates, pattern suggestions. 11 snippets
- Developer tools Maintenance mode, template names, page stats, environment labels and a WP-Cron viewer. 9 snippets
- WooCommerce: shop and product pages Badges, price display, tabs and layout for your shop and product pages. 22 snippets
- WooCommerce: cart and checkout Free-shipping progress, coupon links, quantity limits and a cleaner checkout. 15 snippets
- WooCommerce: account, emails and admin A leaner My account page, handier order lists and emails, and lighter pages. 9 snippets
- More tracking codes Google Ads, TikTok, LinkedIn, Pinterest, Hotjar, Plausible, site verification and a GA4 purchase event. 8 snippets
Library from Snipfire 0.15.1. Written from scratch for Snipfire, free to use on any site. Which plugins can a snippet replace?
Move your snippets over this afternoon.
Importing changes nothing until you switch over, and your old shortcodes keep working.