WP 6.6+
Sanitize Uploaded SVG Files to Prevent Stored XSS Attacks
Enables SVG file uploads while stripping malicious embedded JavaScript tags, onclick handlers, and foreign entities before saving to disk.
Category Archive
Category: Security
WordPress hardening, brute-force mitigation, and permission safeguards.
-
-
WP 6.6+
Force SSL on All WordPress Login and Admin Sessions
Enforces HTTPS encryption on all login forms and wp-admin administrative sessions to prevent session cookie interception on public networks.
-
WP 6.6+
Block Author URL Enumeration Scans (?author=1)
Prevents automated bots from discovering valid WordPress administrator usernames by requesting /?author=1 query parameters.
-
WP 6.6+
Disable WordPress REST API for Unauthenticated Guest Users
Restricts public /wp-json/ user and data endpoints to authenticated users and logged-in administrators only.
-
WP 6.6+
Hide Generic WordPress Login Error Hints to Prevent Username Probing
Replaces informative login error messages (‘Invalid username’ vs ‘Incorrect password’) with a generic notice to prevent credential enumeration.
-
WP 6.6+
Disable XML-RPC Pingbacks and Trackbacks While Keeping Jetpack Active
XML-RPC pingbacks are frequently exploited in large-scale DDoS amplification and brute-force attacks. This snippet disables dangerous pingback methods without breaking Jetpack or the official WordPress mobile app.
-
WP 6.6+
Disable Author Enumeration Scans (?author=1) in WordPress
Attackers and botnets use URL parameters like /?author=1 to reveal administrative usernames. This snippet intercepts query parameters and safely redirects or returns a 404 header.
-
WP 6.6+
Completely Remove WordPress Version String from Header and Feeds
Prevent automated vulnerability scanners from identifying your exact WordPress core version across HTML meta tags, scripts, and RSS feeds.