Plugin directory
All 300+ plugins
21 plugins
Anti-Spam Math Question
Adds a simple arithmetic CAPTCHA to the WordPress comment form — no external service required. Blocks automated spam bots while remaining accessible to real visitors.
v1.0.0SecurityAuto-Logout Idle Users
Automatically logs out users after a configurable idle period with a warning countdown modal.
v1.0.0SecurityComment Blacklist Manager
Manage disallowed words, blocked emails, and blocked IPs that route matching comments to spam or trash.
v1.0.0SecurityComment Length Limit
Enforce configurable minimum and maximum character lengths on WordPress comment submissions. Shows a real-time character counter on the comment form and returns friendly error messages for out-of-range submissions, both server-side and via JavaScript.
v1.0.0SecurityComment Spam Blocker
Blocks or holds comments containing banned keywords, excess links, or from blocked email domains. Lightweight protection with keyword management and link threshold settings.
v1.0.0SecurityCustom Login URL
Changes the WordPress login page URL from wp-login.php to a custom slug. Direct access to wp-login.php returns a 404. Login, logout, and lost-password links are updated automatically.
v1.0.0SecurityDisable File Editor
Disables the built-in WordPress theme and plugin file editors via a settings toggle. Uses an mu-plugin for early-load protection and filters capabilities as a belt-and-suspenders approach. Also optionally disables file modifications and plugin/theme installation.
v1.0.0SecurityDisable XML-RPC
Disable WordPress XML-RPC entirely or block only pingbacks. Removes X-Pingback header, RSD link, and WLW manifest. Supports IP allowlist.
v1.0.0SecurityFailed Login Email Alerts
Emails the admin when failed login attempts exceed a configured threshold within a time window.
v1.0.0SecurityForce Strong Passwords
Enforce configurable password strength rules on profile updates, password resets, and user registration. Shows clear requirements to users.
v1.0.0SecurityFrontend Login Register
Shortcodes for frontend login, registration, and password-reset forms with validation and redirect support.
v1.0.0SecurityHide WP Version
Removes WordPress version fingerprints from your site: generator meta, script/style version strings, RSS generator tags, readme.html, and login error hints.
v1.0.0SecurityHoneypot Spam
Drop-in honeypot + time-trap anti-spam for WordPress forms. No CAPTCHA required. Three mechanisms: honeypot field, time trap, and hidden checkbox trap.
v1.0.0SecurityIP Block List
Blocks access from configured IP addresses or CIDR ranges. Supports full-site, login-only, or login and comment scope. Shows a configurable blocked message or returns HTTP 403.
v1.0.0SecurityLimit Login Attempts
Locks out IP addresses after consecutive failed logins. Configurable thresholds, extended bans, admin whitelist, and lockout log.
v1.0.0SecurityLogin Attempt Logger
Records every login attempt (username, IP, user agent, status) in a custom database table. View, search, filter, and clear the log from Tools → Login Attempts.
v1.0.0SecurityPassword Change Notice Toggle
Independently toggle the "Your password has been changed" notification emails sent to the user and to the admin — with zero code editing.
v1.0.0SecurityPassword Reset Customizer
Customize the WordPress password-reset email (subject, body with placeholders) and brand the wp-login.php reset page with a custom logo, heading, and background color.
v1.0.0SecurityreCAPTCHA on Login & Comments
Adds Google reCAPTCHA v2 or v3 to the login, registration, lost password, and comment forms.
v1.0.0SecuritySecurity Headers Manager
Adds configurable HTTP security headers to every response — X-Frame-Options, CSP, HSTS, Referrer-Policy, and more.
v1.0.0SecurityTwo-Factor Email
Adds email-based two-factor authentication to WordPress. After password login, a 6-digit one-time code is emailed to the user.
v1.0.0