Switch off modules
The Switch off group turns off parts of WordPress most sites never use. Switch each module on from its card in WP Plus+ > Modules. Only Close the REST API to strangers has options; the others work as soon as they are on.
Switch off comments
Closes comments and pingbacks everywhere and hides existing comments on the site. The Comments menu, the Settings > Discussion page and the comments bubble in the admin bar disappear.
Nothing is deleted. Existing comments stay in the database and come back if you switch the module off.
Use the classic editor
Turns the block editor off: posts and pages open in the classic editor, and Appearance > Widgets goes back to the classic widgets screen. The block editor styles also stop loading on the public site.
Content already written with blocks shows as HTML in the classic editor. Try it on one page first. If your theme is a block theme, check the look of your pages after switching it on.
Close the REST API to strangers
The REST API (the addresses under /wp-json) lets other programs read your site's data, including the list of users, to anyone who asks. With this module on, visitors who are not logged in get a 401 error with the message This site requires a login to use the REST API. Logged-in users are not affected, and link previews (oEmbed) keep working.
Routes that stay open: one route per line, part of the route is enough, for example contact-form-7/v1 or wc/store.
- Switch the module on.
- Open your site in a private (incognito) window, where you are not logged in.
- Test your contact forms, shop, cart and checkout, and any page made with a page builder.
- If something breaks, add its route to Routes that stay open and click Save.
Switch off XML-RPC
XML-RPC (/xmlrpc.php) is an old remote interface of WordPress, popular with password-guessing bots because one request can try many passwords. This module stops WordPress accepting logins through it and removes the references to it from your page headers.
The WordPress mobile app and a few old desktop editors use XML-RPC. If someone publishes from the phone app, leave this module off.
Switch off the RSS feeds
Turns off /feed and its variants (posts and comments feeds). Feed addresses answer with This site does not publish a feed. and the feed links disappear from the page head.
Newsletter services and news aggregators that republish your posts usually read the feed. Check before switching this on.
Stop others embedding your pages
Removes the feature that lets other WordPress sites show a preview card of your pages, and the script WordPress loads on every page for it. Embedding other people's content in your pages, such as a YouTube video, keeps working.
Write to us and tell us which plugin, what you tried and what you see. We answer from Italy, usually within one working day.