Admin Menu Editor
Admin Menu Editor lets you manually edit the Dashboard menu. You can reorder the menus, show/hide specific items, change permissions, and more. Features Change menu titles, URLs, icons, CSS classes and so on. Organize menu items via drag & drop. Change menu permissions by setting the required capability or role. Move a menu item to a different submenu. Create custom menus that point to any part of the Dashboard or an external URL. Hide/show any menu or menu item. A hidden menu is invisible to all users, including administrators. The Pro version lets you set per-role menu permissions, hide a menu from everyone except a specific user, export your admin menu, drag items between menu levels, make menus open in a new window and more. Try online demo. Additional Features Despite the name, this plugin is not limited to just editing the admin menu. You can also: Create login redirects and logout redirects. Allow/deny access to specific posts based on user roles. Hide plugins on the Plugins -> Installed Plugins page from other users. Edit the display name, description, and other plugin details shown on the Plugins -> Installed Plugins page (e.g. for white-labelling). Shortcodes The plugin provides a few utility shortcodes. These are mainly intended to help with creating login/logout redirects, but you can also use them in posts and pages. [ame-wp-admin] – URL of the WordPress dashboard (with a trailing slash). [ame-home-url] – Site URL. Usually, this is the same as the URL in the “Site Address” field in Settings -> General. [ame-user-info field="..."] – Information about the logged-in user. Parameters: field – The part of user profile to display. Supported fields include: ID, user_login, display_name, locale, user_nicename, user_url, and so on. placeholder – Optional. Text that will be shown if the visitor is not logged in. encoding – Optional. How to encode or escape the output. This is useful if you want to use the shortcode in your own HTML or JS code. Supported values: auto (default), html, attr, js, none. Notes If you delete any of the default menus they will reappear after saving. This is by design. To get rid of a menu for good, either hide it or change it’s access permissions. In the free version, it’s not possible to give a role access to a menu item that it couldn’t see before. You can only restrict menu access further. In case of emergency, you can reset the menu configuration back to the default by going to http://example.com/wp-admin/?reset_admin_menu=1 (replace example.com with your site URL). You must be logged in as an Administrator to do this.
Turn Off REST API
Turn Off REST API is a lightweight WordPress security plugin that disables the WordPress REST API for visitors who are not logged in. Anonymous requests to your /wp-json endpoints receive an authentication error instead of your site data, while logged in users, your theme, and your plugins keep working normally. By default WordPress exposes a large amount of information through the REST API, including your list of user accounts and usernames, published content, and details about your site. For most sites that open, unauthenticated access is unnecessary and only widens the attack surface for user enumeration and content scraping. Turn Off REST API closes the WordPress REST API to the public in one click, then gives you a clear settings screen to reopen only the specific REST API routes you actually need. Why turn off the WordPress REST API? Stop anonymous user enumeration through /wp-json/wp/v2/users. Reduce your attack surface against REST API based exploits and bots. Keep your content and site data from being scraped through the public API. Stay in control with a per route allow list instead of an all or nothing switch. What it does Returns an authentication error for unauthenticated REST API requests. Optionally removes the REST API discovery links and headers from your page source. Lets you build an allow list of routes that should stay public (for example a contact form or a specific integration). Adds a Site Health check so the restriction is clearly explained and never mistaken for a fault. Keeps the admin area, the block editor, and logged in functionality fully working. Built for control, not breakage Some security plugins disable the REST API completely and break the block editor or third party integrations in the process. Turn Off REST API only blocks unauthenticated access, and the per route allow list means you can whitelist exactly the endpoints a service needs without opening the whole API back up. Developer friendly The access decision runs through the tora_grant_rest_api filter, so developers can extend or override the logic for custom roles, application passwords, or trusted requests.
