404ops Site Options

A tabbed admin options plugin bundling security hardening, performance tuning, admin customization, and database maintenance settings.

404ops Site Options brings several common site-settings jobs together on one 404ops > Site Options screen. Every setting is opt-in: nothing is hardened, optimized or restricted until you check a box and save.

Features

Security hardening: disable the file editor, XML-RPC and its pingback header, and the X-Powered-By header. Hide the WordPress version from the generator tag and feeds, and restrict the REST API to logged-in users.
Failed-login limits per IP address and per username, with escalating lockouts. Login through the form, XML-RPC and application passwords is covered.
A custom login URL, with a recovery key.
IP allow and block lists, with IPv4, IPv6 and CIDR ranges.
Two-factor authentication with an authenticator app, role requirements and a grace period.
Passkeys, with optional passwordless sign-in.
Performance options: disable emoji scripts, oEmbed discovery and Dashicons on the front end, limit post revisions, set the autosave interval, and remove query strings from static assets. You can also hold back the Heartbeat API and set its interval.
Admin customization: custom admin footer text, a custom login-page logo and title, and a forced admin colour scheme. You can hide admin menu entries, admin bar items and dashboard widgets. This is cosmetic: capabilities do not change.
Database maintenance: clean spam comments, orphaned meta, expired transients and unused tags, and optimize tables. Each cleanup runs when you press its button, unless you schedule it. Live database statistics are included.
Settings export and import as JSON, with a preview of the changes before anything is imported.
Multisite: a network-admin screen captures a baseline, shows which sites deviate from it, and pushes it to selected sites. Each site keeps control of its own settings.

Free version

The free version is available on WordPress.org once it is listed there.