Webmasters.Team

WT Hardening is a lightweight, modular security plugin that turns on the most important WordPress hardening measures without modifying your theme, <code>wp-config.php</code>, or <code>.htaccess</code>. Everything works through WordPress hooks and can be disabled at any moment with a single click.
The plugin is completely free, without a PRO version, without ads, and without sending data to external servers. Built by the <a href="https://webmasters.team" rel="nofollow ugc">webmasters.team</a> crew for daily WordPress work.
<h4>Modules</h4>
<ul>
<li>XML-RPC — blocks <code>xmlrpc.php</code> (403) and filters the XML-RPC methods. Stops brute-force attacks through the most attacked WordPress endpoint.</li>
<li>User enumeration — hides logins by blocking <code>/wp/v2/users</code> in the REST API for unauthenticated users.</li>
<li>Author archive — redirects <code>/?author=1</code> to the homepage (another enumeration vector).</li>
<li>Hide WP version — removes the <code><meta name="generator"></code> tag, <code>?ver=</code> query strings from assets, and redundant meta tags (wlwmanifest, rsd, shortlink).</li>
<li>X-Pingback — removes the <code>X-Pingback</code> HTTP header from all responses.</li>
<li>Login errors — replaces the specific “wrong login / wrong password” messages with a single generic text (does not reveal whether a login exists).</li>
<li>Login limiter — blocks an IP for X minutes after N failed attempts. Data lives in a dedicated table (not <code>wp_options</code>), with hourly cleanup of old entries.</li>
<li>File editor — sets <code>DISALLOW_FILE_EDIT</code>, hiding the theme and plugin editor in the admin (an attacker who compromises an account cannot inject a backdoor through the browser).</li>
<li>Password policy — enforces minimum length and complexity (upper and lower case, digits, optionally symbols) for profile updates, registration, and password reset.</li>
<li>Security HTTP headers — <code>X-Frame-Options</code>, <code>X-Content-Type-Options</code>, <code>Referrer-Policy</code>, <code>Permissions-Policy</code>, optionally <code>HSTS</code> (use with care — browsers cache it for a year).</li>
<li>Event log — records logins (successful and failed), registrations, user changes, plugin activations and deactivations, theme switches, and settings updates. Retention defaults to 30 days. Visible in the admin panel.</li>
</ul>
<h4>What makes it different</h4>
<ul>
<li>Modular architecture — each module is a separate class and can be disabled in the settings without affecting the others.</li>
<li>Zero external dependencies — no Composer, no vendor lock-in, no cloud APIs.</li>
<li>No data leaves the instance — everything stays in the local MySQL/MariaDB database.</li>
<li>Internationalization ready — full coverage with <code>__()</code>/<code>esc_html__()</code> and a POT file for translators.</li>
<li>Clean uninstall — when the plugin is removed, options, tables, and cron jobs are dropped.</li>
</ul>
<h4>What WT Hardening does NOT do (by design)</h4>
<ul>
<li>Does not scan for malware — that is a different problem, a different toolset.</li>
<li>Does not ship telemetry to the cloud — all data is local.</li>
<li>Does not add a WAF at the application layer — that belongs to the server or CDN.</li>
</ul>
For those needs we recommend dedicated plugins (e.g. Wordfence) or an infrastructure layer (Cloudflare, fail2ban).

WT Hardening

WordPress hardening without touching your theme: XML-RPC, user enumeration, login limiter, security headers, strong passwords, event log.

Puneet Tiwari

Essentials by Digital Creatings is a lightweight and powerful WordPress plugin designed to improve security, optimize performance, and enhance email functionality. It hides WordPress version exposure, hardens common attack surfaces, removes unnecessary bloat, and lets you configure SMTP and inject custom scripts from a single admin hub.
New in Version 2.0: 
* Modern admin UI — Redesigned dashboard aligned with WordPress 6.x / 7.0 admin patterns 
* Self-hosted assets — No external Bootstrap CDN; faster and more privacy-friendly 
* Unified navigation — Quick access across Security, SMTP, and Custom Scripts 
* Backward compatible — All existing option keys, database tables, and front-end behavior preserved on upgrade
🔒 Security + Optimization + Email + Custom Code in one plugin from Digital Creatings.
Features:
🔹 Security Enhancements: 
– Disable XML-RPC to help prevent brute force attacks 
– Hide WordPress version details (meta, query strings, HTTP headers) 
– Remove REST API links to reduce exposure 
– Disable RSS feeds and feed links 
– Block self-pingbacks and comment spam 
– Remove RSD (Really Simple Discovery) link 
– Remove shortlinks for better privacy
🚀 Performance Optimizations: 
– Disable Emojis to reduce unnecessary script loads 
– Remove jQuery Migrate to improve front-end speed 
– Disable Google Maps API if unused 
– Remove WordPress embeds to prevent external content embedding
📧 SMTP Email Configuration: 
– Configure SMTP settings (Host, Port, Username, Password, Encryption) 
– Choose SMTP or default PHP mail 
– Set custom “From Name” and “From Email” for outgoing emails 
– Send test emails directly from the admin panel
💻 Custom Scripts: 
– Add header, body, or footer snippets 
– Target all pages or specific post/page IDs 
– Stored in a dedicated database table (unchanged in 2.0)
<h3>About Digital Creatings</h3>
Essentials by Digital Creatings is developed and maintained by <a href="https://www.digitalcreatings.com" rel="nofollow ugc">Digital Creatings</a>, a company focused on reliable WordPress solutions for businesses and agencies.
Website: https://www.digitalcreatings.com 
Support: https://www.digitalcreatings.com/contact/
<h3>Support</h3>
For support, please visit <a href="https://www.digitalcreatings.com" rel="nofollow ugc">Digital Creatings</a> or <a href="https://www.digitalcreatings.com/contact/" rel="nofollow ugc">contact us</a>.

Essentials by Digital Creatings

Lightweight WordPress essentials for security, performance, SMTP email, and custom code — built by Digital Creatings.

WT Hardening vs Essentials by Digital Creatings