WordPress Snippets, Explained.
100 categories of Copy-paste PHP, JS, and CSS snippets — each one explains the problem it solves and why the fix works, not just the code.
Recently Published Snippets
Start here — the newest additions to the library.
Disable XML-RPC
Turns off WordPress's XML-RPC endpoint, closing off a common brute-force and DDoS amplification vector that most sites never actually use.
BeginnerDisable the Theme & Plugin File Editor
Removes the built-in Theme and Plugin File Editor from wp-admin, so a compromised admin account can't be used to directly edit PHP files and plant a backdoor.
BeginnerHide the WordPress Version Number
Removes the WordPress version number from your site's HTML, RSS feeds, and asset URLs, so automated scanners can't instantly tell which security patches you're missing.
BeginnerLimit Login Attempts Without a Plugin
Locks out an IP address after repeated failed login attempts using WordPress transients, giving you basic brute-force protection with no dedicated plugin.
Intermediate