Three words are not an explanation
"Disable REST API" tells you nothing about the contact form that stops working, or the shop pages that go blank. You find out from a customer, on a Friday. Here that sentence is on the card, before the switch.
WordPress plugin - twenty-eight modules
Twenty-eight small fixes, and every one explains itself
The things you install a separate plugin for: a cleaner dashboard, a login address that is not the usual one, comments closed for good, your tracking code in the head, uploads resized. Each one is a switch, and each switch tells you what it does, what it changes and what is worth knowing before you press it.
The panel, exactly as it ships. That text under each switch is the whole point.
Replaces the handful you install on every site
- Disable comments
- Login hardening
- Header and footer code
- Image resize
- Duplicate post
Why it exists
The problem was never the number of switches
Plugins like this one have existed for years, some with a hundred options. What none of them has is a straight answer to the only question that matters at the moment you press: what is this going to do to my site?
A big plugin that runs small
Twenty-eight modules, and the ones you did not switch on are never loaded: the file is not read, the class is not built, no hook is registered. The panel shows the running count, so the weight is a number you can check.
Eight plugins, eight update cycles
One for the comments, one for the login, one for the tracking code, one for duplicating a page. Each with its own settings screen, its own updates and its own week where it breaks. This is one plugin and one screen.
What is in it
Twenty-eight modules, in seven groups
Not a feature list written to look long. These are the things we switch on, site after site, before handing a WordPress install to anybody.
Admin area
What you and your clients look at every day.
- Tidy up the admin bar
- Clean up the dashboard
- Hide the admin bar on the site
- Your own text in the footer
- A wider admin menu
Log in and users
The front door of the site, and who comes through it.
- Change the login address
- Limit failed attempts
- Where people land after logging in
- Last login on the users list
Content
Small gaps in how WordPress handles posts and media.
- Duplicate a page or post
- SVG uploads, cleaned on arrival
- External links in a new tab
- Publish missed schedules
Switch off
Parts of WordPress most sites never use, and still pay for.
- Comments
- The block editor
- The REST API for strangers
- XML-RPC, feeds, embeds
Your own code
CSS, tracking tags and the two files people always need to edit.
- CSS in the admin
- CSS on the site
- Head, body and footer code
- robots.txt without a file
Weight and speed
What the database and the browser carry without being asked.
- Limit stored revisions
- Slow down the heartbeat
- Shrink oversized uploads
Tools
Things you need twice a year and never remember how to do.
- Maintenance mode, with a 503
- System summary on the dashboard
Start from a combination
Showcase site, site handed to a client, site with an editorial team.
- Switches on what that kind of site needs
- Touches nothing you had already set
- Every module stays yours to change
7
Modules running on a typical client site, out of twenty-eight. The other twenty-one are never loaded, so they cost that site exactly nothing. The panel shows this number at the top, on purpose.
The difference
The same option, written two ways
This is the whole argument for this plugin. On the left, how a switch like this normally arrives. On the right, how it arrives here.
The usual way
Disable REST API
Disables the WordPress REST API.
So you tick it, because it sounds like a good idea, and three weeks later the contact form stops sending. Nothing told you it would.
WP Plus+
Close the REST API to strangers
Requires a login for the REST API, except for the routes WordPress itself needs.
- When you want it
- By default /wp-json lists your users, your posts and your custom types to anyone who asks. On a company site that is a free map.
- What it does to the site
- Anonymous requests get a 401. Logged in users and the admin are unaffected, and oEmbed keeps working so pasted links still show previews.
- Worth knowing
- Contact forms, shops and page builders often talk to the REST API from the browser. Load a form and the shop pages after switching this on, and add any route that breaks to the list below.
Three combinations to start from. Applying one switches those modules on and leaves everything else alone.
Setup
Nothing happens until you say so
The plugin arrives with everything off. Activating it adds one menu entry and changes nothing else on the site.
1
Install it
Upload the zip from Plugins, Add new. WP Plus+ appears in the menu, with every module off.
2
Pick a combination
Or skip it and switch on the four or five modules you know you want.
3
Read before you press
Open "What changes" on anything you are not sure about. That is what it is there for.
4
Check the site
Open the home page and a form in a private window. Switch a module off and everything is as it was.
Pricing
Five modules free, and they are real modules
Not a trial version with the good parts greyed out. All twenty-eight are there and all of them can be configured: the free version runs the first five you switched on.
Pro
Every module running at the same time, with no limit on how many.
€34,90/ year
1 site · updates included
See the plans
Or unlock everything for 7 days from inside the plugin, with no card
- All 28 modules running at once
- The combinations, applied in full
- New modules as they are added
- Email support from the people who wrote it
The free version runs the first 5 modules you switched on. A module over that limit stays switched on, keeps every option you gave it, and says so on its own card: activating a licence starts it immediately, with nothing to reconfigure.
All prices include VAT. Studio and Agency plans on the pricing page. 14-day refund, no questions asked.
FAQ
The questions people actually ask
It is as heavy as the modules you switched on. A module that is off is not loaded at all: its file is never read from disk, its class is never built, it registers no hook and runs no query. That is why the panel shows the running count at the top, and why it is usually five or six.
No. Every module arrives off. Activating the plugin adds one entry to the menu and does nothing else, so you can install it on a live site at three in the afternoon and look around first.
Switch the module off and the site is exactly as it was. Modules add behaviour while they run; none of them rewrites your content or deletes anything. The two that need a second look before you press, closing the REST API and moving the login address, say so on the card in the part marked "worth knowing".
No. Options are stored per module and stay there. Switch it back on and you find them as you left them. The same is true of the free limit: a module over the fifth keeps every option it had, it simply does not run.
Usually most of them. Switch on the matching module, check the page it affects, then deactivate the old plugin, one at a time rather than all in one afternoon. Where a plugin does much more than one job, a page builder or a full security suite for instance, keep it: this is not trying to be either.
Nothing is hidden and nothing is greyed out: all twenty-eight modules are in the package and all of them can be configured. The free version runs the first five you switched on, and the panel says plainly which ones are switched on but idle. A licence starts the rest, with nothing to set up again.
WordPress 6.0 or later and PHP 7.4 or later. No external service, no API key, no account with us beyond the licence itself. The interface is in English and follows the language set in WordPress; Italian ships with it.
Install it, read one card, and see if we are right
Open any module, press "What changes", and decide whether that is how a setting should be written.
7-day full trial inside the plugin, no card required · 14-day refund