Weston Ruter

This plugin enforces a <a href="https://web.dev/articles/strict-csp" rel="nofollow ugc">Strict Content Security Policy</a> (CSP) on the frontend and login screen. This helps mitigate <a href="https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/XSS" rel="nofollow ugc">cross-site scripting</a> (XSS) vulnerabilities. The policy cannot yet be applied to the WP Admin (see <a href="https://core.trac.wordpress.org/ticket/59446" rel="nofollow ugc">#59446</a>).
In <a href="https://core.trac.wordpress.org/ticket/58664" rel="nofollow ugc">#58664</a>, the manual construction of script tags was eliminated from <code>WP_Scripts</code> and inline scripts on frontend/login screen, thanks to the helper functions which had previously been introduced in <a href="https://core.trac.wordpress.org/ticket/39941" rel="nofollow ugc">#39941</a>. This made it possible to apply Strict CSP, as long as themes and plugins are not directly printing <code><script></code> tags. Some bundled WordPress core themes <a href="https://github.com/search?q=repo%3AWordPress%2Fwordpress-develop+path%3A%2F%5Esrc%5C%2Fwp-content%5C%2Fthemes%5C%2F%2F+%2F%3Cscript%5B%5E%3E%5D*%3E%2F&type=code" rel="nofollow ugc">still do this</a> incorrectly (which has been reported in Trac as <a href="https://core.trac.wordpress.org/ticket/63806" rel="nofollow ugc">#63806</a>). For example, do not do this:
<pre>function my_theme_supports_js() {
 echo '<script>document.body.classList.remove("no-js");</script>'; // ❌
}
add_action( 'wp_footer', 'my_theme_supports_js' );</pre>
Instead, do this:
<pre>function my_theme_supports_js() {
 wp_print_inline_script_tag( 'document.body.classList.remove("no-js");' ); // ✅
}
add_action( 'wp_footer', 'my_theme_supports_js' );</pre>
So in order for scripts to execute, they must be printed using the relevant APIs in WordPress for adding scripts, including <a href="https://developer.wordpress.org/reference/functions/wp_enqueue_script/" rel="nofollow ugc"><code>wp_enqueue_script()</code></a>, <a href="https://developer.wordpress.org/reference/functions/wp_add_inline_script/" rel="nofollow ugc"><code>wp_add_inline_script()</code></a>, <a href="https://developer.wordpress.org/reference/functions/wp_localize_script/" rel="nofollow ugc"><code>wp_localize_script()</code></a>, <a href="https://developer.wordpress.org/reference/functions/wp_print_script_tag/" rel="nofollow ugc"><code>wp_print_script_tag()</code></a>, <a href="https://developer.wordpress.org/reference/functions/wp_print_inline_script_tag/" rel="nofollow ugc"><code>wp_print_inline_script_tag()</code></a>, and <a href="https://developer.wordpress.org/reference/functions/wp_enqueue_script_module/" rel="nofollow ugc"><code>wp_enqueue_script_module()</code></a>. Otherwise, a script’s execution will be blocked and an error will appear in the console, for example:
<blockquote>
Refused to execute inline script because it violates the following Content Security Policy directive: “script-src ‘nonce-9b539cfe47’ ‘unsafe-inline’ ‘strict-dynamic’ https: http:”. Note that ‘unsafe-inline’ is ignored if either a hash or nonce value is present in the source list.
</blockquote>
This also blocks scripts inside of <a href="https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Attributes#event_handler_attributes" rel="nofollow ugc">event handler attributes</a>, such as <code>onclick</code>, <code>onchange</code>, <code>onsubmit</code>, and <code>onload</code>. As noted on MDN:
<blockquote>
Warning: The use of event handler content attributes is discouraged. The mix of HTML and JavaScript often produces unmaintainable code, and the execution of event handler attributes may also be blocked by content security policies.
</blockquote>
This plugin also ensures that scripts added to the page from embeds (e.g. Tweets) also get the <code>nonce</code> attribute added.

Strict CSP

Enforces a Strict Content Security Policy on the frontend and login screen to help mitigate any XSS vulnerabilities.

Janis Elsts

Admin Menu Editor lets you manually edit the Dashboard menu. You can reorder the menus, show/hide specific items, change permissions, and more.
Features
<ul>
<li>Change menu titles, URLs, icons, CSS classes and so on.</li>
<li>Organize menu items via drag & drop.</li>
<li>Change menu permissions by setting the required capability or role.</li>
<li>Move a menu item to a different submenu. </li>
<li>Create custom menus that point to any part of the Dashboard or an external URL.</li>
<li>Hide/show any menu or menu item. A hidden menu is invisible to all users, including administrators.</li>
</ul>
The <a href="http://w-shadow.com/AdminMenuEditor/" rel="nofollow ugc">Pro version</a> lets you set per-role menu permissions, hide a menu from everyone except a specific user, export your admin menu, drag items between menu levels, make menus open in a new window and more. <a href="http://amedemo.com/wpdemo/demo.php" rel="nofollow ugc">Try online demo</a>.
Additional Features
Despite the name, this plugin is not limited to just editing the admin menu. You can also:
<ul>
<li>Create login redirects and logout redirects.</li>
<li>Allow/deny access to specific posts based on user roles.</li>
<li>Hide plugins on the Plugins -> Installed Plugins page from other users.</li>
<li>Edit the display name, description, and other plugin details shown on the Plugins -> Installed Plugins page (e.g. for white-labelling).</li>
</ul>
Shortcodes
The plugin provides a few utility shortcodes. These are mainly intended to help with creating login/logout redirects, but you can also use them in posts and pages.
<ul>
<li><code>[ame-wp-admin]</code> – URL of the WordPress dashboard (with a trailing slash).</li>
<li><code>[ame-home-url]</code> – Site URL. Usually, this is the same as the URL in the “Site Address” field in Settings -> General.</li>
<li><code>[ame-user-info field="..."]</code> – Information about the logged-in user. Parameters:
<ul>
<li><code>field</code> – The part of user profile to display. Supported fields include: <code>ID</code>, <code>user_login</code>, <code>display_name</code>, <code>locale</code>, <code>user_nicename</code>, <code>user_url</code>, and so on.</li>
<li><code>placeholder</code> – Optional. Text that will be shown if the visitor is not logged in.</li>
<li><code>encoding</code> – Optional. How to encode or escape the output. This is useful if you want to use the shortcode in your own HTML or JS code. Supported values: <code>auto</code> (default), <code>html</code>, <code>attr</code>, <code>js</code>, <code>none</code>.</li>
</ul>
</li>
</ul>
Notes
<ul>
<li>If you delete any of the default menus they will reappear after saving. This is by design. To get rid of a menu for good, either hide it or change it’s access permissions.</li>
<li>In the free version, it’s not possible to give a role access to a menu item that it couldn’t see before. You can only restrict menu access further.</li>
<li>In case of emergency, you can reset the menu configuration back to the default by going to http://example.com/wp-admin/?reset_admin_menu=1 (replace example.com with your site URL). You must be logged in as an Administrator to do this.</li>
</ul>

Admin Menu Editor

Does just what it says it does. Instantly.

Perfect

I've been a user of Admin Menu Editor and the Pro version for a while now. WordPress backend can get a little messy very easily, so this plugin comes to the rescue, and it does it well.

I wish all the features were free, but the devs need to pay the bills as well :-)

Best option


It allows you to move existing items on the left side menu around and change their icons.


Not Bad, simple to use


Essential for taming the admin menu, due to all the stupid ideas other developers have for their menus!


Essential

Lets you edit the WordPress admin menu. You can re-order, hide or rename menus, add custom menus and more.

Strict CSP vs Admin Menu Editor