Pinny Fried

Pinny’s Multi Admin lets you add multiple admin email recipients to WordPress notifications so your entire team receives important site alerts.
By default, WordPress only sends administrative notifications to the single email address configured in Settings → General. This plugin simply extends WordPress’ native notification system and adds additional recipients.
With this lightweight plugin you can add as many additional admin email addresses as you want. All of these emails will receive:
<ul>
<li>New user registration notifications</li>
<li>Password change alerts</li>
<li>Core update notifications</li>
<li>Plugin and theme automatic update reports</li>
<li>Fatal error recovery mode emails</li>
<li>Other administrative alerts generated by WordPress</li>
</ul>
Perfect for agencies, development teams, site owners, and anyone who wants multiple people to receive critical WordPress notifications.
Plugin Size: Ultra lightweight — only 1.5KB!
<h3>Common Use Cases</h3>
Agencies 
Receive important WordPress notifications across your entire team instead of relying on a single admin email.
Development Teams 
Ensure developers, project managers, and site owners all receive plugin updates, core update notices, and critical error alerts.
Site Owners 
Add a backup email so important alerts like password changes, security notices, or recovery mode emails never go unnoticed.
Client Websites 
Send WordPress admin notifications to both the developer and the client for full transparency.
Features:
<ul>
<li>Add unlimited additional admin email recipients</li>
<li>Appears directly in Settings → General</li>
<li>Supports comma-separated or one-per-line email input</li>
<li>Automatic email validation and deduplication</li>
<li>Extends WordPress’ native notification emails</li>
<li>Ultra lightweight — ~1.5 KB zipped</li>
<li>Clean uninstall</li>
</ul>
<h3>Ultra Lightweight</h3>
Pinny’s Multi Admins is intentionally minimal.
There are:
<ul>
<li>No dashboards</li>
<li>No JavaScript</li>
<li>No CSS</li>
<li>No tracking</li>
<li>No telemetry</li>
<li>No performance impact</li>
</ul>
Plugin size: ~1.5 KB zipped

Pinny's Multi Admin – Add Multiple Admin Emails

Add multiple admin email recipients to WordPress notifications so your team receives updates, errors, and user registration alerts.

Blocks public REST API user enumeration while preserving full WordPress functionality.
Pinny’s REST Lock is an ultra-lightweight security plugin that locks down WordPress REST API user endpoints without breaking your site.
It is designed to fix one of the most common and overlooked WordPress security issues — public user enumeration via the REST API — using the correct, core-aligned approach.
<h3>🚨 Why This Plugin Is Necessary</h3>
By default, WordPress publicly exposes REST API endpoints such as:
<pre><code>/wp-json/wp/v2/users
</code></pre>
On public sites, these endpoints can be accessed without authentication and are routinely used as the first step in real-world attacks.
This is where attackers start.
Public access to REST user endpoints allows attackers to:
<ul>
<li>Enumerate valid usernames</li>
<li>Identify administrator and privileged accounts</li>
<li>Eliminate guesswork before brute-force attacks</li>
<li>Chain enumeration with login abuse and password reset attacks</li>
</ul>
This is not theoretical. User enumeration is a baseline reconnaissance technique used by bots and human attackers alike.
Blocking public access to REST user endpoints should be considered required security hygiene for every WordPress site.
<h3>⚠️ Common REST Protection Pitfalls</h3>
Securing REST user endpoints requires precision. Broad or poorly timed restrictions often introduce serious side effects.
Common issues include:
<ul>
<li>Blocking all users, including administrators, which breaks authenticated workflows</li>
<li>Disabling the REST API entirely, causing the block editor, WooCommerce, and modern plugins to fail</li>
<li>Applying restrictions before authentication, preventing WordPress from distinguishing public and authorized requests</li>
<li>Allowing low-privilege roles, such as subscribers, to retain access — leaving user enumeration possible</li>
</ul>
Effective protection must be narrowly scoped, permission-aware, and aligned with WordPress core behavior.
<h3>✅ How Pinny’s REST Lock Works</h3>
Pinny’s REST Lock takes a surgical, WordPress-native approach:
<ul>
<li>Targets only REST API user endpoints</li>
<li>Runs after WordPress authentication</li>
<li>Allows access only to users with appropriate permissions</li>
<li>Returns a proper <code>403 Forbidden</code> response to unauthorized requests</li>
</ul>
What this means:
<ul>
<li>Administrators continue to work normally</li>
<li>The REST API remains fully functional</li>
<li>Gutenberg, WooCommerce, and REST-based plugins are unaffected</li>
<li>Only public user enumeration is blocked</li>
</ul>
This follows WordPress core’s intended permission model.
<h3>🚀 Ultra-Lightweight by Design</h3>
Pinny’s REST Lock is intentionally minimal:
<ul>
<li>~1.3 KB uncompressed</li>
<li>Single-file plugin</li>
<li>No settings page</li>
<li>No database tables</li>
<li>No logs</li>
<li>No tracking</li>
<li>No ads</li>
<li>No performance impact</li>
</ul>
It activates, applies the protection, and gets out of the way.
<h3>🛡️ A Required Fix for Modern WordPress Sites</h3>
If your site is public, your REST user endpoints should not be.
Pinny’s REST Lock closes one of the most common entry points attackers look for — without breaking WordPress, without blocking admins, and without adding bloat.
Install it. Activate it. And remove an entire class of attacks from your site.

Pinny’s REST Lock – Block REST User Enumeration

Prevents public access to REST API user endpoints while allowing authorized roles.

Pinny's Multi Admin – Add Multiple Admin Emails vs Pinny’s REST Lock – Block REST User Enumeration