badegg

<p><strong>Hard Boiled Security</strong> stands in contrast to the many heavily marketed security plugins available for WordPress. Rather than providing a barrage of configuration options and intrusive prompts and upsells, we silently close the most common security vulnerabilities.</p>
<p>This plugin was inspired by many painful situations we helped people out of over the years and developed to help people who do not code secure websites their with minimal effort.</p>
<h3>Plugin Features</h3>
<ul>
<li>Zero configuration, hardens security just by activating</li>
<li>Disables all file editing within WordPress Admin.</li>
<li>Pingbacks and Trackbacks are disabled on all existing and future posts.</li>
<li>Prevents username exposure by ensuring their nice name, which is used in their profile URL and Rest API endpoint, is not their username. Those with the <code>list_users</code> capability can change this if needed.</li>
<li>Tested and working with <a href="https://roots.io/bedrock" rel="nofollow ugc">Roots.io’s Bedrock</a> directory structure as a mu-plugin.</li>
</ul>
<h3>Planned features</h3>
<p>There is more we can do to harden your WordPress website’s security. The features we will implement in the future will also be opinionated and require little to no configuration.<br />
– Block brute force attacks by limiting failed login attempts within a reasonable timeframe<br />
– Prevent email server spam and abuse by limiting password reset requests<br />
– Logging when brute force and spam prevention measures are triggered with optional opt-in email notifications</p>
<h3>Keep it secret, keep it safe</h3>
<p>This plugin is not a magic fix-all security solution. We don’t believe any plugin can do that.</p>
<p>Website security, regardless of platform, requires careful consideration around common security principles around access and permissions. Things like always using strong passwords, never reusing them across multiple websites, and limiting administrator accounts to those who actually need it. So many WordPress websites are compromised because administrator access is given out where the editor role is perfectly sufficient. Even if you are the website owner, using an editor account for your daily activities is a good idea.</p>
<h3>What to do to stay secure beyond using this plugin</h3>
<ul>
<li>Strong, unique, randomised passwords.</li>
<li>Fewer administrator accounts given only to those that need access to how the website works.</li>
<li>Use editor accounts or lower for regular content updates where possible.</li>
<li>Ensure the plugins and themes you use have been updated within the last few months.</li>
<li>Abandoned themes or plugins will not be updated if security vulnerabilities are found so replace them.</li>
</ul>
<h3>Why this plugin may not be for you</h3>
<p>This is an opinionated plugin built around our assumptions. These assumptions are based on our experiences over 15 years of building WordPress websites and may go against your workflow or philosophy.</p>
<p>One of the main reasons we wrote this plugin is to create an easy way for people to disable the built-in file editor in the WordPress admin. A compromised administrator account can easily add malicious code to any theme or plugin and it can be very difficult to detect and locate it. This is the main reason we disable this feature outright. Secondly, if you’re writing code, we consider it to be bad practice to edit files directly in a production environment (ie, a live website).</p>


Hard Boiled Security

A simple plugin that hardens some common Wordpress vulnerabilities

Vladimir Garagulya

<p>User Role Editor WordPress plugin allows you to change user roles and capabilities easy.<br />
Just turn on check boxes of capabilities you wish to add to the selected role and click “Update” button to save your changes. That’s done.<br />
Add new roles and customize its capabilities according to your needs, from scratch of as a copy of other existing role.<br />
Unnecessary self-made role can be deleted if there are no users whom such role is assigned.<br />
Role assigned every new created user by default may be changed too.<br />
Capabilities could be assigned on per user basis. Multiple roles could be assigned to user simultaneously.<br />
You can add new capabilities and remove unnecessary capabilities which could be left from uninstalled plugins.<br />
Multi-site support is provided.</p>
<p>To read more about ‘User Role Editor’ visit <a href="https://www.shinephp.com/user-role-editor-wordpress-plugin/" rel="nofollow ugc">this page</a></p>
<p>Do you need more functionality with quality support in a real time? Do you wish to remove advertisements from User Role Editor pages?<br />
<a href="https://www.role-editor.com" rel="nofollow ugc">Buy Pro version</a>.<br />
<a href="https://www.role-editor.com" rel="nofollow ugc">User Role Editor Pro</a> includes extra modules:</p>
<ul>
<li>Block selected admin menu items for role.</li>
<li>Hide selected front-end menu items for no logged-in visitors, logged-in users, roles.</li>
<li>Block selected widgets under “Appearance” menu for role.</li>
<li>Show widgets at front-end for selected roles.</li>
<li>Block selected meta boxes (dashboard, posts, pages, custom post types) for role.</li>
<li>“Export/Import” module. You can export user role to the local file and import it to any WordPress site or other sites of the multi-site WordPress network.</li>
<li>Roles and Users permissions management via Network Admin  for multisite configuration. One click Synchronization to the whole network.</li>
<li>“Other roles access” module allows to define which other roles user with current role may see at WordPress: dropdown menus, e.g assign role to user editing user profile, etc.</li>
<li>Manage user access to editing posts/pages/custom post type using posts/pages, authors, taxonomies ID list.</li>
<li>Per plugin users access management for plugins activate/deactivate operations.</li>
<li>Per form users access management for Gravity Forms plugin.</li>
<li>Shortcode to show enclosed content to the users with selected roles only.</li>
<li>Posts and pages view restrictions for selected roles.</li>
<li>Admin back-end pages permissions viewer</li>
</ul>
<p>Pro version is advertisement free. Premium support is included.</p>
<h3>Additional Documentation</h3>
<p>You can find more information about “User Role Editor” plugin at <a href="http://www.shinephp.com/user-role-editor-wordpress-plugin/" rel="nofollow ugc">this page</a></p>
<p>I am ready to answer on your questions about plugin usage. Use <a href="http://www.shinephp.com/user-role-editor-wordpress-plugin/" rel="nofollow ugc">plugin page comments</a> for that.</p>


User Role Editor


Más sencillo de usar que otros plugins similares y me ha solucionado un problema que no podía solucionar con otro plugin similar.



Con otro plugin muy parecido tuve el problema de que no distinguía entre mayúsculas y minúsculas, con lo que asignaba mal las "capabilities" si estás tenían mayúsculas.



Con este plugin, problema resuelto.


Ha funcionado donde otros no


A powerfull, logical, native approach to capabilities and roles, without the need to code it all. Great stuff. Probably the best solution out there.


Amazing plugin


Really awesome plugin. I use it for my website. Where lot of customer of CodeAstrology.


Awesome plugin - I use it for my site

User Role Editor WordPress plugin makes user roles and capabilities changing easy. Edit/add/delete WordPress user roles and capabilities.

Hard Boiled Security vs User Role Editor