Title: Improve Website Security Author: ideasToCode Published: December 28, 2024 Last modified: December 4, 2025 --- Search plugins ![](https://ps.w.org/improve-website-security/assets/banner-772x250.png?rev=3214252) ![](https://ps.w.org/improve-website-security/assets/icon-256x256.png?rev=3214247) # Improve Website Security By [ideasToCode](https://profiles.wordpress.org/ideastocode/) [Download](https://downloads.wordpress.org/plugin/improve-website-security.1.0.1.zip) [Live Preview](https://wordpress.org/plugins/improve-website-security/?preview=1) * [Details](https://wordpress.org/plugins/improve-website-security/#description) * [Reviews](https://wordpress.org/plugins/improve-website-security/#reviews) * [Installation](https://wordpress.org/plugins/improve-website-security/#installation) * [Development](https://wordpress.org/plugins/improve-website-security/#developers) [Support](https://wordpress.org/support/plugin/improve-website-security/) ## Description WordPress security is essential to protect your website from hackers and malicious attacks. Without proper security measures, your site can be vulnerable to data breaches, spam, and unauthorized access. A well-secured WordPress site ensures that your content, user data, and website functionality remain safe from threats. This plugin boosts your WordPress security with several key features: 1. Security Headers: Adds extra layers of protection by sending security headers with each page load. 2. Change WP Login Error Message: Hides whether the username or password is incorrect, preventing hackers from easily guessing your login details. 3. Disable WP REST API: Stops unauthorized access to your site’s data by disabling the REST API for non-logged-in users. 4. Disable XML-RPC: Blocks XML-RPC functionality to prevent brute force attacks and unauthorized access. 5. Disable Right-Click: Adds a basic level of protection against copying your site content by disabling right-clicking. 6. Disable Ctrl+C, Ctrl+X, Ctrl+V, Ctrl+A: It will disable these shortcuts, preventing copying of site content. 7. Email Alerts on Login: Sends the site admin an email alert every time someone logs into the WordPress dashboard. 8. Change Default WP-Login URL: Customize your WordPress Login Page URL to any name instead of the default ‘wp-admin.’ Special Feature: If you’re locked out of your WordPress Dashboard (e.g., forgot the custom login URL), you can deactivate the plugin using a special URL. This allows you to regain access without needing to log in to cPanel or FTP. **Tutorial video** If you want to learn more about how this plugin works, please check our [website – ideastocode.com](https://ideastocode.com/plugins/improve-wp-security-plugin/). ### External services This plugin connects to an API to obtain the IP address and country name, which are required to display the details when someone logs in to your WordPress dashboard. It sends the logged-in user’s IP address and country information when they log in. If you are using WP Login Email Alerts, you are giving consent to use this service. This service is provided by ipapi (ipapi.co): [Terms of Service](https://ipapi.co/terms/) ## Screenshots * [[ * Backend settings * [[ * Change Login URL * [[ * Plugin Deactivation URL * [[ * ReadMe ## Installation Improve Website Security can be installed directly on your website. 1. Log in to your site’s dashboard, i.e., /wp-admin. 2. Then go to Plugins Add New. 3. Search for Improve Website Security or ideasToCode. 4. Locate the Improve Website Security & click on Install Now. 5. Activate the plugin Navigate to Settings. ## FAQ ### Can the Improve Website Security be used with all themes? Yes, you can use this plugin with any theme. We have tested it with popular themes such as Enfold, Avada, Elementor page builder, Astra, Divi, and more, and it works perfectly. ### How to check if the Security Headers have been added to the site? Please review your website at [Security Headers](https://securityheaders.com). Turn on the feature in the plugin, and you will get an A+ score. ### Why is my Security Header score different on other sites? This is because this plugin does not add all the Content Security Policies (CSP). Some CSPs are very tricky and can break the site, so only a basic level of CSP has been added. This ensures safety while allowing the site to function properly. It doesn’t block every script or URL. ### What is “Change WP Login Error Message”? When you try to log in to your WordPress site (wp-admin) and enter the wrong username or the correct username with the wrong password, WordPress, by default, shows whether the password is incorrect or the username doesn’t exist. This can be a security risk, as it reveals information to attackers. With this plugin, the error message displayed is “Incorrect Username or Password,” so hackers can’t tell if the username was correct. ### How to check if WP REST API has been disabled? First, open your website in a new browser and check the URL yoursiteurl.com/wp-json. If you see a lot of information, it means the API is enabled. After enabling the plugin, check the same URL, and you should see an error message hiding everything. Make sure you are checking in incognito mode or another browser, as the plugin will not affect logged-in users. ### How to check if xmlrpc.php is enabled or disabled? Simply go to yourwebsite.com/xmlrpc.php. If you see the message “XML-RPC server accepts POST requests only,” it means it is enabled. After disabling this option in the plugin, this link will either show nothing, display a “page not found” error, or another type of error. ### What is the “Disable Right Click” feature? This feature adds a basic level of protection. Anyone trying to right-click on your site will not be able to do so. Also, this method is not 100% secure for copying content or images, but it does provide a simple level of protection for less tech- savvy users. ### What is the “Disable Ctrl+C, Ctrl+X, Ctrl+V, Ctrl+A:” feature? With this enabled, site visitors cannot use these keyboard shortcuts, thus protecting the site’s content. Again, please note this is not a 100% solution for content protection, but it does restrict many users from easily stealing the content. ### What is “Email Alerts on Login”? This feature sends an email to the admin (only) whenever someone accesses your WordPress dashboard. The email includes the username, country, IP address, and time of the login attempt. ### Why didn’t I receive an email alert on login? This could be due to the configuration on your website. Please install the WP Mail SMTP plugin and check if it’s working properly. You can [Check this tutorial video](https://letslearnwordpress.com/wordpress/wordpress-smtp-plugin) if it’s not working. ### How to change wp-admin default login URL? It is very easy to change the default login with this plugin. Simply go to the tab Change Login URL and add any SecretKey, which could be a text or numbers you want to use for login. You can then access the dashboard with yoursite.com/SecretKey or yoursite.com/wp-admin?SecretKey or yoursite.com/wp-login?SecretKey. ### Why isn’t /SecretKey working? One of the reasons for it not working could be the Permalinks settings. Make sure the permalinks are not set to Plain. Additionally, make sure to clear the cache of your site. And we recommend using wp-login?SecretKey as this should always work. The last option, if you cannot access your site, is by using the Plugin Deactivation feature. ### What is the “Plugin Deactivation URL” feature? This feature allows you to deactivate your plugin. It can be extremely useful, especially if you have forgotten your customized login URL. Please note, after the plugin is deactivated, you can log back into your site with the default login URL wp-admin and then reset the login URL. A new deactivation URL will be generated every time you deactivate and activate the plugin. This is for safety because, in case anyone finds out about your deactivation URL, we do not want it to be misused. ## Reviews ![](https://secure.gravatar.com/avatar/1fa5c4be5407de73c6b50d6160d4ecdde47a27a7419138c556bb444b996bdbdb? s=60&d=retro&r=g) ### 󠀁[Loved the Security Headers!](https://wordpress.org/support/topic/loved-the-security-headers/)󠁿 [saujanpradhan](https://profiles.wordpress.org/saujanpradhan/) January 5, 2025 For free I got A+ at security headers website!!!!! Though it doesn’t add the CSP but it’s fine! Also reduced number of plugins to be installed as it has so many other useful add ons! [ Read all 1 review ](https://wordpress.org/support/plugin/improve-website-security/reviews/) ## Contributors & Developers “Improve Website Security” is open source software. The following people have contributed to this plugin. Contributors * [ ideasToCode ](https://profiles.wordpress.org/ideastocode/) “Improve Website Security” has been translated into 1 locale. Thank you to [the translators](https://translate.wordpress.org/projects/wp-plugins/improve-website-security/contributors) for their contributions. [Translate “Improve Website Security” into your language.](https://translate.wordpress.org/projects/wp-plugins/improve-website-security) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/improve-website-security/), check out the [SVN repository](https://plugins.svn.wordpress.org/improve-website-security/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/improve-website-security/) by [RSS](https://plugins.trac.wordpress.org/log/improve-website-security/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.0.0 * Initial release. ## Meta * Version **1.0.1** * Last updated **4 months ago** * Active installations **30+** * WordPress version ** 5.5 or higher ** * Tested up to **6.9.4** * PHP version ** 7.0 or higher ** * Languages * [English (US)](https://wordpress.org/plugins/improve-website-security/) and [Russian](https://ru.wordpress.org/plugins/improve-website-security/). * [Translate into your language](https://translate.wordpress.org/projects/wp-plugins/improve-website-security) * Tags * [disable right click](https://wordpress.org/plugins/tags/disable-right-click/) [disable-json-api](https://wordpress.org/plugins/tags/disable-json-api/)[Security Headers](https://wordpress.org/plugins/tags/security-headers/) * [Advanced View](https://wordpress.org/plugins/improve-website-security/advanced/) ## Ratings 5 out of 5 stars. * [ 1 5-star review ](https://wordpress.org/support/plugin/improve-website-security/reviews/?filter=5) * [ 0 4-star reviews ](https://wordpress.org/support/plugin/improve-website-security/reviews/?filter=4) * [ 0 3-star reviews ](https://wordpress.org/support/plugin/improve-website-security/reviews/?filter=3) * [ 0 2-star reviews ](https://wordpress.org/support/plugin/improve-website-security/reviews/?filter=2) * [ 0 1-star reviews ](https://wordpress.org/support/plugin/improve-website-security/reviews/?filter=1) [Add my review](https://wordpress.org/support/plugin/improve-website-security/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/improve-website-security/reviews/) ## Contributors * [ ideasToCode ](https://profiles.wordpress.org/ideastocode/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/improve-website-security/) ## Donate Would you like to support the advancement of this plugin? [ Donate to this plugin ](https://ideastocode.com/)