Selvakumaran Krishnan

<p>WM Secure and Optimize plugin is your all-in-one solution for managing both the security and performance of your WordPress website. It’s a free and open-source plugin developed and maintained by <a href="https://www.wikimint.com/p/developer-innovation-hub.html" rel="nofollow ugc">Wikimint Developer</a>.</p>
<h3>Features:</h3>
<ol>
<li>
<p><strong>Enhanced Security:</strong></p>
<ul>
<li>Harden the security of your site with advanced protection measures.</li>
<li>Set up robust site protection to safeguard against potential threats.</li>
</ul>
</li>
<li>
<p><strong>Performance Optimization:</strong></p>
<ul>
<li>Optimize your site’s performance by disabling and removing unnecessary features.</li>
<li>Fine-tune settings for optimal speed and responsiveness.</li>
</ul>
</li>
<li>
<p><strong>Under Construction/Maintenance Mode:</strong></p>
<ul>
<li>Easily put your site under construction or maintenance mode.</li>
<li>Choose from a variety of maintenance page themes to keep your visitors informed.</li>
</ul>
</li>
</ol>
<h3>Usage</h3>
<h3>Security Configuration:</h3>
<ul>
<li>Access the ‘Security’ section in the plugin settings to harden your site’s security.</li>
<li>Configure options for firewall protection, login attempt monitoring, and more.</li>
</ul>
<h3>Performance Optimization:</h3>
<ul>
<li>Navigate to the ‘Performance’ section to optimize your site’s speed.</li>
<li>Disable and remove unwanted features for a streamlined user experience.</li>
</ul>
<h3>Maintenance Mode:</h3>
<ul>
<li>Visit the ‘Maintenance Mode’ section to enable or disable construction/maintenance mode.</li>
<li>Explore various maintenance page themes to keep your visitors engaged during downtime.</li>
</ul>
<h3>Key Features:</h3>
<p>🛡 <strong>Robust Security Measures</strong>: Implement top-notch security protocols to safeguard your site from malicious attacks and unauthorized access. “WM Secure and Optimize” provides a comprehensive suite of security features, including firewall protection, login attempt monitoring, and more.</p>
<p>⚙️ <strong>Performance Optimization</strong>: Say goodbye to sluggish load times. Our plugin streamlines your website’s performance, optimizing images, caching content, and fine-tuning settings for optimal speed. Experience a faster, more responsive site that keeps visitors engaged.</p>
<p>🔐 <strong>Enhanced Login Security</strong>: Protect your login pages with advanced security measures. Choose from multi-factor authentication options, CAPTCHA integration, and IP blocking to fortify your site’s first line of defense.</p>
<p>🚀 <strong>Effortless Setup and Configuration</strong>: No technical expertise required. With a user-friendly interface, “WM Secure and Optimize” ensures a hassle-free setup. Configure security and performance settings with ease, and start seeing results immediately.</p>
<p>📈 <strong>Detailed Analytics</strong>: Gain insights into your site’s security and performance with detailed analytics. Track login attempts, monitor resource usage, and receive actionable data to make informed decisions for further optimization.</p>
<p>✅ <strong>Regular Updates and Support</strong>: Stay ahead of the curve with regular updates that adapt to evolving security challenges. Our dedicated support team is ready to assist you with any questions or issues you may encounter.</p>
<p>🔒 <strong>Peace of Mind for Site Owners</strong>: Rest easy knowing that your WordPress site is fortified against potential threats and delivering a seamless experience for your visitors.</p>
<h3>Support and Feedback</h3>
<p>If you encounter any issues or have questions, feel free to reach out to our <a href="https://developer.wikimint.com/p/contact.html" rel="nofollow ugc">support team</a>.</p>
<p>We appreciate your feedback! Share your experience and suggestions to help us improve “WM Secure and Optimize” for everyone.</p>
<p>Download “WM Secure and Optimize” now and take the first step towards a more secure and high-performing WordPress website.</p>
<p>WM Secure and Optimize: Enhance Your WordPress Site’s Security and Performance</p>
<p>Boost the security and performance of your WordPress website with the powerful “WM Secure and Optimize” plugin. This all-in-one solution is designed to fortify your site against potential threats while optimizing its speed for an unparalleled user experience.</p>
<h3>Online Web Tools Integration</h3>
<p>Enhance your web development experience with seamlessly <a href="https://developer.wikimint.com/p/tools.html" rel="nofollow ugc">integrated online web tools</a> here developed by Wikimint Developer.</p>
<p>Stay within character limits seamlessly with real-time tracking, optimizing your messaging for various platforms.</p>


WM Secure and Optimize

Best light weight plugin for site security and optimization

Nice plugin to secure and optimize your site

One place for site security and site performance. Secure and optimize your site to perform better. WM Secure and Optimize

Brendigo

<p>BrenWP Client Safe Mode helps you troubleshoot safely and reduce risk when handing a WordPress site to clients or non-technical users.</p>
<p>Safe Mode is <em>per-user</em>: it applies only to the currently logged-in user who enabled it. Visitors and other users are not affected.</p>
<h4>Safe Mode (per-user) can optionally</h4>
<ul>
<li>Block access to risky wp-admin screens (plugin/theme management, core updates, Site Health, and update actions)</li>
<li>Disable file modifications (plugin/theme installs, updates, editors)</li>
<li>Optionally block update/install capabilities (prevents running updates/installs even via alternative flows)</li>
<li>Optionally block destructive capabilities (prevents deleting plugins/themes while Safe Mode is enabled)</li>
<li>Optionally disable the built-in plugin/theme editors (capability-based) while Safe Mode is enabled</li>
<li>Hide update notices</li>
<li>Trim selected admin bar nodes (Updates / Comments / New Content)</li>
<li>Auto-disable after a configurable number of minutes (optional)</li>
</ul>
<h4>Client restrictions (role-based + optional user targeting) can</h4>
<ul>
<li>Optionally target a specific user account (in addition to roles)</li>
<li>Hide risky menus</li>
<li>Block direct access to sensitive wp-admin screens</li>
<li>Disable file modifications</li>
<li>Hide update notices</li>
<li>Optionally limit the Media Library to a user’s own uploads (privacy on multi-author sites)</li>
<li>Optionally hide common Dashboard widgets for restricted roles (UI cleanup)</li>
<li>Optionally hide the Screen Options dropdown (independent toggle)</li>
<li>Optionally hide the Admin Bar on the front end for restricted roles</li>
<li>Optionally block Customizer access (customize.php)</li>
<li>Optionally block Users screens (Users list/Add/Edit) even if the broader screen blocklist is disabled</li>
<li>Optionally block Tools screens (Tools/Import/Export) even if the broader screen blocklist is disabled</li>
<li>Optionally lock profile email/password changes for restricted roles (prevents self-service account takeover)</li>
<li>Optionally show a dismissible 2FA security reminder notice (notice only)</li>
<li>Optionally hide the Admin Bar on the front end for restricted roles</li>
</ul>
<h4>General hardening (site-wide, optional)</h4>
<ul>
<li>Disable XML-RPC</li>
<li>Disable the built-in plugin/theme editors for all users (capability-based)</li>
<li>Optional settings export download (admin-only) via a nonce-protected endpoint (default OFF)</li>
</ul>
<p>Administrators are never restricted by client restrictions. On multisite, super-admins are also excluded.</p>
<h4>Privacy</h4>
<p>This plugin does not send data to external services. It performs <strong>no tracking, telemetry, analytics, or “phone-home” requests</strong>.</p>
<h4>Data stored on your site</h4>
<p>The plugin stores the minimum required data to provide Safe Mode and optional auditing:</p>
<ul>
<li><strong>Options (Settings)</strong>: stored in the <code>brenwp_csm_options</code> option (site option). This contains your configured settings.</li>
<li><strong>Activity log (optional)</strong>: stored in the <code>brenwp_csm_activity_log</code> option <strong>only if Activity logging is enabled</strong>. This log is bounded by <strong>Max entries</strong> and can optionally be pruned by age (Retention days).</li>
<li><strong>Operational options</strong>: internal housekeeping options such as <code>brenwp_csm_last_settings_change</code> and a short-lived lock key used to avoid concurrent log writes.</li>
<li><strong>User meta (Safe Mode)</strong>:
<ul>
<li><code>brenwp_csm_safe_mode</code> (on/off flag for a user)</li>
<li><code>brenwp_csm_safe_mode_until</code> (optional expiry timestamp if auto-off is enabled)</li>
</ul>
</li>
</ul>
<h4>Data minimization and retention</h4>
<ul>
<li>Activity logging is <strong>disabled by default</strong>.</li>
<li>The activity log does <strong>not</strong> store IP addresses and attempts to redact likely secrets from context values.</li>
<li>Retention controls:
<ul>
<li><strong>Max entries</strong> caps log size.</li>
<li><strong>Retention days</strong> can automatically prune older entries (0 = disabled).</li>
<li>The <strong>Clear log</strong> action removes all log entries immediately (admin-only, nonce protected).</li>
</ul>
</li>
</ul>
<h4>Privacy tools</h4>
<p>The plugin:<br />
* Adds suggested text to the Privacy Policy Guide (Settings <span aria-hidden="true" class="wp-exclude-emoji">→</span> Privacy)<br />
* Registers a personal data exporter and eraser for the Safe Mode user meta</p>
<h4>Data deletion</h4>
<p>On uninstall (delete), the plugin removes its options, optional log option, Safe Mode user meta, and (best-effort) the optional <code>bren_client</code> role if it was created by the plugin.</p>
<h3>Security</h3>
<p>This plugin follows WordPress hardening best practices:</p>
<ul>
<li><strong>CSRF protection</strong>: all state-changing actions use <strong>POST</strong> and require a <strong>WordPress nonce</strong>.</li>
<li><strong>Authorization</strong>: privileged admin actions are gated by <strong>capability checks</strong> (<code>manage_options</code> by default, filterable).</li>
<li><strong>XSS defense</strong>: user-controlled data is sanitized on input and escaped on output.</li>
<li><strong>No remote requests</strong>: the plugin does not make outbound HTTP requests.</li>
<li><strong>Data minimization</strong>: the activity log is bounded, does not store IP addresses, and redacts likely secrets in log context values.</li>
</ul>
<p>Assumptions and scope:</p>
<ul>
<li>The plugin enforces policies inside WordPress; it does not replace server/WAF hardening.</li>
<li>Safe Mode is <strong>per-user</strong> and does not modify the site’s active plugins/themes list.</li>
</ul>
<h3>Troubleshooting</h3>
<h4>I don’t see the Safe Mode toggle in the admin bar</h4>
<ul>
<li>Confirm the WordPress admin bar is enabled for your account.</li>
<li>Confirm <strong>Enforcement</strong> is enabled in the plugin settings.</li>
<li>Confirm your role is included in <strong>Who can toggle Safe Mode</strong> (or you are an administrator / multisite super-admin).</li>
</ul>
<h4>My profile email/password cannot be changed</h4>
<p>If <strong>Restrictions <span aria-hidden="true" class="wp-exclude-emoji">→</span> Lock profile email/password</strong> is enabled and your account is restricted, you will not be able to change your own email or password. Contact an administrator.</p>
<h4>XML-RPC stopped working</h4>
<p>If you rely on legacy services that require XML-RPC (some old mobile apps / integrations), disable <strong>General <span aria-hidden="true" class="wp-exclude-emoji">→</span> Disable XML-RPC</strong>.</p>
<h4>I get redirected with an “Access blocked” notice</h4>
<p>A configured policy blocked a sensitive admin screen. Review:<br />
* <strong>Restrictions <span aria-hidden="true" class="wp-exclude-emoji">→</span> Block direct screen access</strong> (for restricted roles)<br />
* <strong>Safe Mode <span aria-hidden="true" class="wp-exclude-emoji">→</span> Block risky admin screens</strong> (for your account if Safe Mode is enabled)</p>
<h4>Safe Mode is enabled but I want to turn it off</h4>
<ul>
<li>Use the <strong>Safe Mode</strong> tab to toggle it off.</li>
<li>If auto-off is enabled, it will disable automatically after the configured time window.</li>
<li>If Enforcement is OFF, the UI provides a <strong>Clear stored Safe Mode</strong> button to remove the stored flag.</li>
</ul>
<h3>Developer Hooks</h3>
<p>Filters:<br />
* <code>brenwp_csm_required_cap</code> — change the capability required to manage this plugin (default: <code>manage_options</code>).<br />
* <code>brenwp_csm_presets</code> — customize Dashboard presets (label/description/patch arrays).<br />
* <code>brenwp_csm_create_client_role</code> — return <code>false</code> to prevent creating the <code>bren_client</code> role on activation.<br />
* <code>brenwp_csm_client_role_caps</code> — customize capabilities assigned to the <code>bren_client</code> role on activation.<br />
* <code>brenwp_csm_remove_client_role_on_uninstall</code> — return <code>false</code> to keep the <code>bren_client</code> role during uninstall cleanup.</p>


BrenWP Client Safe Mode

Per-user Safe Mode plus role-based client restrictions for safer troubleshooting and cleaner client handoff.

WM Secure and Optimize vs BrenWP Client Safe Mode