Problem page
Close common entry points and unnecessary public data without installing a complete security suite.
In plain language
For sites that want fewer scans, bots, spam, and unwanted access.
Quick choice
Every plugin below handles one small part. Install only what you need.
Recommended plugins
Disable XML-RPC Only
Helps withReduce abuse, scans, and unwanted access
Disables WordPress XML-RPC without adding broader security or cleanup changes.
Disable REST API User Endpoints
Helps withReduce abuse, scans, and unwanted access
Hides and blocks `/wp/v2/users` REST API endpoints for users who cannot list users.
Disable Application Passwords
Helps withReduce abuse, scans, and unwanted access
Turns off WordPress application passwords.
Disable Self Pingbacks
Helps withCalm down comments and spam
Prevents WordPress from creating pingbacks when a site links to its own content.
Remove REST API Head Links
Helps withReduce abuse, scans, and unwanted access
Removes REST API discovery links from the document head and HTTP headers.
Remove WordPress Generator
Helps withClean up SEO noise
Removes the WordPress generator meta tag and generator output.
Remove Recent Comments Style
Helps withCalm down comments and spam
Removes the legacy Recent Comments widget inline CSS from the document head.
Disable Smilies
Helps withSolve one small WordPress annoyance
Disables WordPress text smilie conversion in content, excerpts, and comments.
Disable Widget Block Editor
Helps withSolve one small WordPress annoyance
Restores the classic widgets screen by disabling the block widget editor.
Disable File Editor
Helps withSolve one small WordPress annoyance
Disables the built-in plugin and theme file editors in wp-admin.
Disable File Modifications
Helps withSolve one small WordPress annoyance
Disables plugin/theme installs, updates, and file edits from wp-admin.
Disable Comment Emails
Helps withReduce unnecessary WordPress emails
Stops WordPress from emailing post authors about new comments.
Remove Admin Bar Comments
Helps withMake wp-admin easier to work in
Removes the comments shortcut from the WordPress admin bar.
Disable Login Error Hints
Helps withMake the login page calmer
Replaces detailed WordPress login errors with a generic message.
Block Author Enumeration
Helps withSolve one small WordPress annoyance
Redirects public ?author= requests to prevent basic username enumeration.
Disable Comments Globally
Helps withCalm down comments and spam
Closes comments and pings across public post types and hides the comments admin menu.
Disable Trackbacks
Helps withCalm down comments and spam
Closes trackbacks and removes trackback support from public post types.
Disable XML-RPC Pingbacks
Helps withCalm down comments and spam
Disables XML-RPC pingback methods while leaving other XML-RPC methods available.
Disable REST API for Visitors
Helps withReduce abuse, scans, and unwanted access
Blocks REST API requests from logged-out visitors.
Disable Comment Reply Script
Helps withCalm down comments and spam
Dequeues the WordPress comment-reply script on the public front end.
Disable Attachment Comments
Helps withCalm down comments and spam
Closes comments and pings on attachment pages.
Woo Product Reviews
Helps withClean up product pages
Closes comments on WooCommerce products and removes product comment support.
Remove Yoast Comments
Helps withCalm down comments and spam
Removes Yoast SEO debug marker comments from the front-end page source.
Disable Comment Website Field
Helps withCalm down comments and spam
Removes the website URL field from the default WordPress comment form.
Disable Comment Author Cookies
Helps withCalm down comments and spam
Stops WordPress from storing comment author name, email, and URL cookies after comments.
Disable Comment Cookies Consent Checkbox
Helps withCalm down comments and spam
Removes the default comment cookies consent checkbox from WordPress comment forms.
Disable XML-RPC Authentication
Helps withReduce abuse, scans, and unwanted access
Blocks username and password authentication attempts made through WordPress XML-RPC.
Remove X-Pingback Header
Helps withCalm down comments and spam
Removes the X-Pingback HTTP header from WordPress front-end responses.