badegg

<p><strong>Hard Boiled Security</strong> stands in contrast to the many heavily marketed security plugins available for WordPress. Rather than providing a barrage of configuration options and intrusive prompts and upsells, we silently close the most common security vulnerabilities.</p>
<p>This plugin was inspired by many painful situations we helped people out of over the years and developed to help people who do not code secure websites their with minimal effort.</p>
<h3>Plugin Features</h3>
<ul>
<li>Zero configuration, hardens security just by activating</li>
<li>Disables all file editing within WordPress Admin.</li>
<li>Pingbacks and Trackbacks are disabled on all existing and future posts.</li>
<li>Prevents username exposure by ensuring their nice name, which is used in their profile URL and Rest API endpoint, is not their username. Those with the <code>list_users</code> capability can change this if needed.</li>
<li>Tested and working with <a href="https://roots.io/bedrock" rel="nofollow ugc">Roots.io’s Bedrock</a> directory structure as a mu-plugin.</li>
</ul>
<h3>Planned features</h3>
<p>There is more we can do to harden your WordPress website’s security. The features we will implement in the future will also be opinionated and require little to no configuration.<br />
– Block brute force attacks by limiting failed login attempts within a reasonable timeframe<br />
– Prevent email server spam and abuse by limiting password reset requests<br />
– Logging when brute force and spam prevention measures are triggered with optional opt-in email notifications</p>
<h3>Keep it secret, keep it safe</h3>
<p>This plugin is not a magic fix-all security solution. We don’t believe any plugin can do that.</p>
<p>Website security, regardless of platform, requires careful consideration around common security principles around access and permissions. Things like always using strong passwords, never reusing them across multiple websites, and limiting administrator accounts to those who actually need it. So many WordPress websites are compromised because administrator access is given out where the editor role is perfectly sufficient. Even if you are the website owner, using an editor account for your daily activities is a good idea.</p>
<h3>What to do to stay secure beyond using this plugin</h3>
<ul>
<li>Strong, unique, randomised passwords.</li>
<li>Fewer administrator accounts given only to those that need access to how the website works.</li>
<li>Use editor accounts or lower for regular content updates where possible.</li>
<li>Ensure the plugins and themes you use have been updated within the last few months.</li>
<li>Abandoned themes or plugins will not be updated if security vulnerabilities are found so replace them.</li>
</ul>
<h3>Why this plugin may not be for you</h3>
<p>This is an opinionated plugin built around our assumptions. These assumptions are based on our experiences over 15 years of building WordPress websites and may go against your workflow or philosophy.</p>
<p>One of the main reasons we wrote this plugin is to create an easy way for people to disable the built-in file editor in the WordPress admin. A compromised administrator account can easily add malicious code to any theme or plugin and it can be very difficult to detect and locate it. This is the main reason we disable this feature outright. Secondly, if you’re writing code, we consider it to be bad practice to edit files directly in a production environment (ie, a live website).</p>


Hard Boiled Security

A simple plugin that hardens some common Wordpress vulnerabilities

Janis Elsts

<p>Admin Menu Editor lets you manually edit the Dashboard menu. You can reorder the menus, show/hide specific items, change permissions, and more.</p>
<p><strong>Features</strong></p>
<ul>
<li>Change menu titles, URLs, icons, CSS classes and so on.</li>
<li>Organize menu items via drag & drop.</li>
<li>Change menu permissions by setting the required capability or role.</li>
<li>Move a menu item to a different submenu. </li>
<li>Create custom menus that point to any part of the Dashboard or an external URL.</li>
<li>Hide/show any menu or menu item. A hidden menu is invisible to all users, including administrators.</li>
</ul>
<p>The <a href="http://w-shadow.com/AdminMenuEditor/" rel="nofollow ugc">Pro version</a> lets you set per-role menu permissions, hide a menu from everyone except a specific user, export your admin menu, drag items between menu levels, make menus open in a new window and more. <a href="http://amedemo.com/wpdemo/demo.php" rel="nofollow ugc">Try online demo</a>.</p>
<p><strong>Additional Features</strong></p>
<p>Despite the name, this plugin is not limited to just editing the admin menu. You can also:</p>
<ul>
<li>Create login redirects and logout redirects.</li>
<li>Allow/deny access to specific posts based on user roles.</li>
<li>Hide plugins on the <em>Plugins -> Installed Plugins</em> page from other users.</li>
<li>Edit the display name, description, and other plugin details shown on the <em>Plugins -> Installed Plugins</em> page (e.g. for white-labelling).</li>
</ul>
<p><strong>Shortcodes</strong></p>
<p>The plugin provides a few utility shortcodes. These are mainly intended to help with creating login/logout redirects, but you can also use them in posts and pages.</p>
<ul>
<li><code>[ame-wp-admin]</code> – URL of the WordPress dashboard (with a trailing slash).</li>
<li><code>[ame-home-url]</code> – Site URL. Usually, this is the same as the URL in the “Site Address” field in <em>Settings -> General</em>.</li>
<li><code>[ame-user-info field="..."]</code> – Information about the logged-in user. Parameters:
<ul>
<li><code>field</code> – The part of user profile to display. Supported fields include: <code>ID</code>, <code>user_login</code>, <code>display_name</code>, <code>locale</code>, <code>user_nicename</code>, <code>user_url</code>, and so on.</li>
<li><code>placeholder</code> – Optional. Text that will be shown if the visitor is not logged in.</li>
<li><code>encoding</code> – Optional. How to encode or escape the output. This is useful if you want to use the shortcode in your own HTML or JS code. Supported values: <code>auto</code> (default), <code>html</code>, <code>attr</code>, <code>js</code>, <code>none</code>.</li>
</ul>
</li>
</ul>
<p><strong>Notes</strong></p>
<ul>
<li>If you delete any of the default menus they will reappear after saving. This is by design. To get rid of a menu for good, either hide it or change it’s access permissions.</li>
<li>In the free version, it’s not possible to give a role access to a menu item that it couldn’t see before. You can only restrict menu access further.</li>
<li>In case of emergency, you can reset the menu configuration back to the default by going to http://example.com/wp-admin/?reset_admin_menu=1 (replace example.com with your site URL). You must be logged in as an Administrator to do this.</li>
</ul>


Admin Menu Editor

Does just what it says it does. Instantly.

Perfect

I've been a user of Admin Menu Editor and the Pro version for a while now. WordPress backend can get a little messy very easily, so this plugin comes to the rescue, and it does it well.

I wish all the features were free, but the devs need to pay the bills as well :-)

Best option


It allows you to move existing items on the left side menu around and change their icons.


Not Bad, simple to use


Essential for taming the admin menu, due to all the stupid ideas other developers have for their menus!


Essential

Lets you edit the WordPress admin menu. You can re-order, hide or rename menus, add custom menus and more.

Hard Boiled Security vs Admin Menu Editor