Login and security extras

• PHP Login Log in with the email address only Users log in with their email address; user names are no longer accepted. Attackers usually guess user names, not email addresses. Set up first
• PHP Users Passwords of at least 12 characters Users can’t set a password shorter than 12 characters when they reset it, register or edit their profile.
• PHP Login Hide the language switcher on the login page Removes the language dropdown under the login form (it appears when more than one language is installed).
• HTML Login Tick “Remember me” by default The “Remember me” box on the login page starts ticked.
• CSS Login Your colours on the login page Gives the login page your background and button colours. Change the three colour values to match your brand.
• PHP Login No password resets by email for administrators The “Lost your password?” link can’t be used to reset an administrator’s password. If an admin’s mailbox is ever hacked, the site isn’t.
• PHP Login Limit login attempts After 5 failed logins from the same IP address in 15 minutes, that address has to wait 15 minutes before trying again. Slows down password guessing.
• PHP Security Don’t announce the PHP version Removes the X-Powered-By header that tells every visitor (and every scanner) which PHP version the server runs.
• PHP Security Send visitors to the HTTPS address Visitors who open a page over plain http are redirected to the same page on https. Only runs on the live site (production), so local copies keep working. Set up first
• PHP Security Spam trap in the registration form Adds a hidden field to the wp-login.php registration form that bots fill in and people never see. Those registrations are refused.
• PHP SEO Keep staging sites out of search engines On staging, development and local copies of the site, every page tells search engines not to index it. The live site isn’t touched.

All packs and snippets