DFX Random User IDs
This WordPress plugin randomizes the user_id for the user created on WordPress setup, removing one potential attack factor from the site. How it works Once activated, the plugin will immediately replace the ID for the default admin user (with user ID 1). By default, the plugin will use random user IDs between 1 and 4503599627370495 (to ensure compatibility with Javascript code using the user ID). All newly created users from that moment will be generated with a random user ID in the defined range. How to customize the range for new user IDs You can customize the range used by the plugin for the random generated user IDs by using the WordPress filters dfx_random_user_id_max_id and dfx_random_user_id_min_id. For example, if you want to have all your user IDs between 1000 and 9999 you can add the following lines to your theme’s functions.php file: function set_dfx_max_user_id( $default_max_id ) { return 9999; } add_filter( 'dfx_random_user_id_max_id', 'set_dfx_max_user_id' ); function set_dfx_min_user_id( $default_max_id ) { return 1000; } add_filter( 'dfx_random_user_id_min_id', 'set_dfx_min_user_id' ); Probably, you’ll want to add these lines to your code before activating the plugin, so your new random main admin user ID is inside your desired range.
WP Anti-Clickjack
WP Anti-Clickjack is a powerful security plugin that helps prevent your WordPress site from being vulnerable to clickjacking attacks. Clickjacking is a malicious technique where an attacker tricks users into clicking on a concealed link or button by overlaying it on your legitimate website. This plugin implements two key defense mechanisms: Frame protection headers: The plugin adds the X-Frame-Options: SAMEORIGIN and Content-Security-Policy: frame-ancestors 'self' HTTP headers to your site’s pages. They instruct web browsers to prevent other websites from embedding your site within an iframe, effectively blocking clickjacking attempts. A Content-Security-Policy your site already sends is left in place, and WordPress post embeds stay embeddable on other sites. OWASP’s Legacy Browser Frame Breaking Script: The plugin includes a modified version of OWASP’s legacy browser frame breaking script. This script prevents other sites from putting your site in an iframe, even in browsers that don’t support the X-Frame-Options header. The script is optimized to work seamlessly in browsers with and without JavaScript enabled. By combining these two security measures, WP Anti-Clickjack provides comprehensive protection against clickjacking attacks, ensuring the safety and integrity of your WordPress site. For more information about clickjacking defense techniques, refer to the OWASP Clickjacking Defense Cheat Sheet. Features Adds the X-Frame-Options: SAMEORIGIN and Content-Security-Policy: frame-ancestors 'self' HTTP headers to prevent clickjacking Works alongside your existing Content-Security-Policy, including nonce-based policies, and keeps framing headers your server or another plugin already sends Settings > Anti-Clickjack screen to let sites you choose (like your other domains or a partner) frame your site, also available as the wp_anti_clickjack_allowed_origins filter Site Health check that loads your homepage like a visitor and warns if a page cache, CDN or server setting drops or duplicates the headers “Check from outside” button that has ClickJack Test load your homepage from the internet, through your CDN, and shows what it sees “Test your site” link on the Plugins screen Includes a modified version of OWASP’s legacy browser frame breaking script Compatible with popular page builders and editors like Elementor, Divi, WPBakery, Bricks, Breakdance, Oxygen, and more Provides filters to disable the anti-clickjacking measures when needed Easy to install and configure Regularly updated and tested with the latest WordPress versions Additional Details To disable the clickjacking JavaScript, use the following filter in your theme’s functions.php file. It receives true or false and runs last, so you can also return false only on specific pages: add_filter('wp_anti_clickjack', '__return_false'); To disable the clickjacking HTTP headers (X-Frame-Options and Content-Security-Policy: frame-ancestors), use this filter in your theme’s functions.php file: add_filter('wp_anti_clickjack_x_frame_options_header', '__return_false'); To let other sites put your site in a frame, add them under Settings > Anti-Clickjack, one per line. Developers can use this filter instead (it also receives the sites saved in the settings). Wildcards work for subdomains, and the frame breaking script allows the same sites: add_filter( 'wp_anti_clickjack_allowed_origins', function ( $origins ) { $origins[] = 'https://partner.example'; $origins[] = 'https://*.example.com'; return $origins; } ); If your WordPress admin runs on a different domain than your site, that domain is allowed automatically so page builders and previews keep working. Page builder and editor previews are detected only for logged-in users who can edit posts, so a visitor cannot switch the protection off by adding a page builder parameter to a URL. If your server, CDN or another plugin already sends an X-Frame-Options header or a frame-ancestors policy, the plugin leaves them as they are and doesn’t add its own. External services The “Check from outside” button and the “Test your site” link use ClickJack Test, a free clickjacking tester. Nothing is sent unless an administrator clicks one of them. When they do, your homepage address is sent to clickjacktest.com, which requests that address from the internet and reports the framing headers it receives. No other data about your site or its users is sent. See ClickJack Test’s terms of use and privacy policy.
