Title: Hopelessly Sensible: Simple Security Hardening
Author: Hebble & Stone CIC
Published: <strong>September 11, 2026</strong>
Last modified: September 11, 2026

---

Search plugins

![](https://ps.w.org/hopelessly-sensible/assets/banner-772x250.png?rev=3690973)

![](https://ps.w.org/hopelessly-sensible/assets/icon-256x256.png?rev=3690973)

# Hopelessly Sensible: Simple Security Hardening

 By [Hebble & Stone CIC](https://profiles.wordpress.org/hebblestone/)

[Download](https://downloads.wordpress.org/plugin/hopelessly-sensible.1.1.1.zip)

 * [Details](https://wordpress.org/plugins/hopelessly-sensible/#description)
 * [Reviews](https://wordpress.org/plugins/hopelessly-sensible/#reviews)
 * [Development](https://wordpress.org/plugins/hopelessly-sensible/#developers)

 [Support](https://wordpress.org/support/plugin/hopelessly-sensible/)

## Description

Most security plugins are built for people who enjoy security. This one is built
for everyone else: the person who looks after a small charity’s website on a Tuesday
evening and would like to stop worrying about it.

It does seven things. Each one has a switch, a plain-English explanation of what
it does, and an honest note about what it might break. No notification badges, no
upgrade prompts, no counting of attacks repelled, and nothing anywhere in your dashboard
trying to sell you something.

**It describes your site as it is today.**

Everything on the settings screen is about your site now, not about what it looked
like the day you installed this. If four people publish posts here, it says four.
If three comments are approved and hidden from your visitors, it says so, and tells
you how to get rid of them for good if that is what you want.

**It sets up what is safe, and leaves the rest to you.**

When you activate it, the plugin looks at your site and switches on what is safe
here. If you have one writer, it hides author pages. If nobody has approved a comment
in a year, it closes comments. Three of the seven are never switched on for you,
because they take something away from you rather than from a visitor, and that decision
is yours to make.

**If something changes, it stands down and tells you.**

If a setting stops being safe to leave on, this plugin switches it off by itself.
Install something that needs remote publishing and blocking remote publishing goes
off, rather than sitting there reading as on while quietly breaking your new plugin.
When that happens you get one notice, once, saying what changed and why, and you
can dismiss it for good. It is the only thing this plugin will ever show you outside
its own settings screen, and it only ever appears because something has already 
happened.

A switch that is off is never turned on behind your back. That direction is always
yours.

**What it does**

 * Keeps your list of users and their usernames away from anonymous visitors
 * Gives the same short message whether a login failed on the username or the password
 * Hides author pages, and keeps writers out of your sitemap and link previews
 * Blocks XML-RPC, an old remote publishing interface popular with password-guessing
   tools
 * Closes comments everywhere, and leaves WooCommerce reviews alone unless you say
   otherwise
 * Closes WooCommerce product reviews, if you want that
 * Locks the theme and plugin file editors in the dashboard
 * Warns you if you have a user called “admin”, and does nothing else about it

**What it does not do**

 * It does not write to your .htaccess file, your wp-config.php, or anything outside
   its own single settings row. Deactivate it and your site is exactly as it was,
   immediately.
 * It adds no JavaScript to your dashboard.
 * It does not scan, does not phone home, does not collect anything, and has no 
   paid version.
 * It does not give you homework. There is no checklist, no score, and no red badge
   waiting for you.
 * It does not hide options from you. Anything this plugin cannot do on your site
   is still on the screen, switched off, saying what is stopping it.

Free and open source, GPL, written by Hebble & Stone, a community interest company
that builds websites for charities.

## Screenshots

[⌊The settings screen. Every option carries a plain explanation and a note on what
it might break.⌉⌊The settings screen. Every option carries a plain explanation and
a note on what it might break.⌉[

The settings screen. Every option carries a plain explanation and a note on what
it might break.

[⌊An option this site cannot use, still on the screen, saying what is stopping it.⌉⌊
An option this site cannot use, still on the screen, saying what is stopping it.⌉[

An option this site cannot use, still on the screen, saying what is stopping it.

## FAQ

### Will this break my site?

Any of these settings can change how something works, which is why each one carries
a warning saying what. The two that most often surprise people are closing comments,
which hides discussion your visitors may be part of and takes the Comments screen
out of your dashboard while it is on, and locking the file editor, which stops you
editing theme files from the dashboard. Both are explained on the settings screen
before you touch them. Nothing is deleted either way: switch comments back on and
everything is where you left it.

### What happens if I deactivate it?

Everything goes back to how it was, straight away. The plugin makes no permanent
changes to your site, so there is nothing to undo. Uninstalling removes its single
row from your options table.

### Does it work with WooCommerce?

Yes, and carefully. WooCommerce reviews are stored as comments, so closing comments
would ordinarily take your product reviews and star ratings with them. This plugin
never does that. Reviews have their own separate option, off by default, which sits
on the screen switched off and explained if WooCommerce is not installed. Order 
notes, which are also stored as comments, are never touched by anything here.

One thing to know if your shop is running an old WooCommerce. Closing comments takes
the Comments screen out of your dashboard, and WooCommerce moved review moderation
to its own screen under Products in version 6.7. On WooCommerce 6.7 or later this
is fine, and you carry on approving reviews as normal. On anything older, reviews
are still moderated on the Comments screen, so this plugin leaves that screen reachable
on those shops rather than taking review moderation away from you.

### Does it work on multisite?

Yes, but activate it on each site rather than across the whole network. Activating
for the network means it cannot look at your sites one by one, so every option starts
where it starts rather than where the plugin would have put it, and it says so on
the settings screen. Activated site by site, it looks at each one properly. Either
way the settings are per site, so what you choose on one site does not affect another.

### Will it stop someone hacking my site?

No plugin can promise that, and you should be wary of any that implies it. This 
one closes off a set of well-known ways that automated tools gather information 
and guess passwords. That is worth doing, and it is not the same thing as being 
safe. Strong passwords, two-factor authentication, and keeping WordPress and its
plugins updated matter more than anything here.

### Why is there no scanning, firewall, or login limiting?

Because those need attention, and this plugin is built to be set once and forgotten.
Features that generate alerts generate work, and work gets ignored, and ignored 
alerts are worse than no alerts.

### I have a user called “admin” and it is warning me. What do I do?

WordPress does not let you rename a user. The usual route is to create a second 
administrator account with a different username, log in as that one, delete the “
admin” account, and hand its posts over to the new account when WordPress asks.

## Reviews

![](https://secure.gravatar.com/avatar/f4083af61daf2e4a2dbb805650d7fd29e178f72ee86e1ba7b8f3a9ed7468e63b?
s=60&d=retro&r=g)

### 󠀁[Finally, thank you](https://wordpress.org/support/topic/finally-thank-you-3/)󠁿

 [ulimc](https://profiles.wordpress.org/ulimc/) September 11, 2026

It seems very lightweight and doing its job. Will surely use it on my projects to
replace some of the more bulky ones.BONUS: "No notification badges, no upgrade prompts"
<– this is gold, i am usually frustrated by this on plugins, so THANK YOU.

 [ Read all 1 review ](https://wordpress.org/support/plugin/hopelessly-sensible/reviews/)

## Contributors & Developers

“Hopelessly Sensible: Simple Security Hardening” is open source software. The following
people have contributed to this plugin.

Contributors

 *   [ Hebble & Stone CIC ](https://profiles.wordpress.org/hebblestone/)
 *   [ Matt Bedford ](https://profiles.wordpress.org/mattbedford/)

[Translate “Hopelessly Sensible: Simple Security Hardening” into your language.](https://translate.wordpress.org/projects/wp-plugins/hopelessly-sensible)

### Interested in development?

[Browse the code](https://plugins.trac.wordpress.org/browser/hopelessly-sensible/),
check out the [SVN repository](https://plugins.svn.wordpress.org/hopelessly-sensible/),
or subscribe to the [development log](https://plugins.trac.wordpress.org/log/hopelessly-sensible/)
by [RSS](https://plugins.trac.wordpress.org/log/hopelessly-sensible/?limit=100&mode=stop_on_copy&format=rss).

## Changelog

#### 1.1.1

 * Changed: three messages borrowed from WordPress itself (the vague login error,
   the remote publishing refusal and the user list refusal) are now translatable
   as part of this plugin, as the plugin directory requires, rather than inheriting
   the translations WordPress ships with.

#### 1.1.0

 * Fixed: on WordPress 7.1, “Block remote publishing” could not be switched on at
   all, and switched itself off on sites that had it on. WordPress 7.1 began using
   the same hook this plugin watches to work out whether anything on your site needs
   remote publishing, and the plugin read that as your site needing it.
 * Added: “Lock the file editor” is now blocked, with an explanation, on sites where
   a published GeneratePress element runs PHP. GeneratePress stops running that 
   code while the editor is locked, and prints the code into the page instead.
 * Changed: the warning under “Lock the file editor” now mentions code snippets 
   plugins, some of which stop running their code when the editor is locked.
 * Tested against WordPress 7.1.

#### 1.0.0

 * First release.

## Meta

 *  Version **1.1.1**
 *  Last updated **11 hours ago**
 *  Active installations **Fewer than 10**
 *  WordPress version ** 6.5 or higher **
 *  Tested up to **7.1**
 *  PHP version ** 7.4 or higher **
 * Tags
 * [comments](https://wordpress.org/plugins/tags/comments/)[hardening](https://wordpress.org/plugins/tags/hardening/)
   [privacy](https://wordpress.org/plugins/tags/privacy/)[security](https://wordpress.org/plugins/tags/security/)
   [xmlrpc](https://wordpress.org/plugins/tags/xmlrpc/)
 *  [Advanced View](https://wordpress.org/plugins/hopelessly-sensible/advanced/)

## Ratings

 5 out of 5 stars.

 *  [  1 5-star review     ](https://wordpress.org/support/plugin/hopelessly-sensible/reviews/?filter=5)
 *  [  0 4-star reviews     ](https://wordpress.org/support/plugin/hopelessly-sensible/reviews/?filter=4)
 *  [  0 3-star reviews     ](https://wordpress.org/support/plugin/hopelessly-sensible/reviews/?filter=3)
 *  [  0 2-star reviews     ](https://wordpress.org/support/plugin/hopelessly-sensible/reviews/?filter=2)
 *  [  0 1-star reviews     ](https://wordpress.org/support/plugin/hopelessly-sensible/reviews/?filter=1)

[Your review](https://wordpress.org/support/plugin/hopelessly-sensible/reviews/#new-post)

[See all reviews](https://wordpress.org/support/plugin/hopelessly-sensible/reviews/)

## Contributors

 *   [ Hebble & Stone CIC ](https://profiles.wordpress.org/hebblestone/)
 *   [ Matt Bedford ](https://profiles.wordpress.org/mattbedford/)

## Support

Got something to say? Need help?

 [View support forum](https://wordpress.org/support/plugin/hopelessly-sensible/)