Hopelessly Sensible: Simple Security Hardening
The settings screen. Every option carries a plain explanation and a note on what it might break.
Most WordPress security plugins are heavy and slow. This one is simple, light and reliable.
It does seven things. Each one has a switch, a plain-English explanation of what it does and an honest note about what it might break. No notification badges, no upgrade banners and nothing in your dashboard trying to sell you something.
It sets up what is safe and leaves you in charge
When you activate it, Hopelessly Sensible looks at your site and switches on everything that is safe here. Protections that take a feature away from you are left off, so that call stays yours.
If something changes, it stands down and tells you
If a setting stops being safe to leave on, this plugin switches it off by itself and gives you one clear, dismissible notice saying what changed and why. It is the only thing this plugin ever shows you outside its own settings screen. A switch that is off is never turned on behind your back.
What it does
- Keeps your list of users and their usernames away from anonymous visitors
- Gives the same short message whether a login failed due to the username or the password
- Hides author pages and keeps writers out of your sitemap and link previews
- Blocks XML-RPC, an old remote publishing interface popular with password-guessing tools
- Optionally: closes comments everywhere
- Optionally: closes WooCommerce product reviews
- Optionally: locks the theme and plugin file editors in the dashboard
- Warns you if you have a user called “admin”, and explains how to fix it
What it does not do
- It does not write to your .htaccess file, your wp-config.php or anything outside its own single settings row. Deactivate it and your site is exactly as it was, immediately.
- It adds no JavaScript to your dashboard.
- It does not scan, does not phone home, does not collect any data and has no paid version.
- It does not give you homework. There is no checklist, no score and no red badge waiting for you.
- It does not hide options from you. Anything this plugin cannot do on your site is still on the screen, switched off, saying what is stopping it.
Free and open source, GPL, written by Hebble & Stone, a community interest company that builds websites for charities, organisations and small businesses.