Shortcodes Ultimate – Content Elements
🌟 Building new pages with Gutenberg? Explore VovaBlocks, a focused collection of native marketing and content blocks from the creator of Shortcodes Ultimate. View VovaBlocks → ➡️ About Shortcodes Ultimate Shortcodes Ultimate is a WordPress shortcode plugin for adding tabs, accordions, buttons, FAQs, sliders, carousels, lightboxes, columns, boxes and other reusable content elements without coding. It is ideal for site owners who want richer content layouts and practical UI elements without switching to a full page builder. Use Shortcodes Ultimate in the Block Editor, Classic Editor, widgets and template files. Generate shortcodes visually, preview the result before inserting it, and reuse the same elements across posts, pages and existing shortcode-based content. Trusted by hundreds of thousands of WordPress sites, Shortcodes Ultimate helps you replace multiple single-purpose UI plugins with one maintained toolkit. Explore live examples What you can build With Shortcodes Ultimate, you can quickly add common WordPress content elements such as: Accordions and FAQ sections Responsive tabs CTA buttons and download buttons Boxes, notes and callouts Columns and layout helpers Sliders and carousels Lightboxes for images and custom content Post lists and dynamic content blocks Spoilers, toggles and expandable content Media embeds and visual content blocks Instead of installing a separate plugin for every small content element, Shortcodes Ultimate gives you one maintained toolkit for everyday WordPress content tasks. Works with modern and classic WordPress workflows Shortcodes Ultimate works with the Block Editor, Classic Editor, widgets and template files. You can insert shortcodes manually, use WordPress shortcode blocks or use the built-in shortcode generator to configure elements visually. This makes the plugin useful for: Site owners who want to improve content without coding Bloggers and affiliate publishers who need reusable CTA and content blocks Agencies and freelancers maintaining multiple WordPress sites Developers who want shortcode-friendly output in templates Existing sites with older content that already uses shortcodes Why use Shortcodes Ultimate? 50+ ready-to-use WordPress shortcodes Visual shortcode generator Live preview Works with the Block Editor and Classic Editor Shortcodes can be used in posts, pages, widgets and template files Responsive elements that work with your theme Built-in Custom CSS editor Developer-friendly hooks and documentation Free version available on WordPress.org Pro version available for advanced shortcodes, extra styles and premium support Why shortcodes still matter in WordPress The WordPress Block Editor is great for visual content editing, but shortcodes are still useful when you need portable, reusable content elements that work across different parts of a WordPress site. Shortcodes are especially helpful when you want to: Reuse the same content element in many posts or pages Add dynamic content inside widgets or templates Maintain older WordPress sites that already use shortcodes Work across Classic Editor and Block Editor workflows Add content elements without switching to a full page builder Keep common UI elements available through a simple text-based syntax Shortcodes Ultimate is designed for these practical workflows. It gives you a large collection of ready-made shortcodes and a visual generator, so you do not need to write shortcode syntax manually unless you want to. Free and Pro The free version of Shortcodes Ultimate includes a large collection of useful shortcodes for everyday WordPress content tasks. Shortcodes Ultimate Pro adds advanced shortcodes, additional styles, Content Slider, Pricing Table, Testimonials, Shortcode Creator, Elementor support and premium support. Compare Free and Pro Useful links Documentation Live Examples Pro features Support
WP Anti-Clickjack
WP Anti-Clickjack is a powerful security plugin that helps prevent your WordPress site from being vulnerable to clickjacking attacks. Clickjacking is a malicious technique where an attacker tricks users into clicking on a concealed link or button by overlaying it on your legitimate website. This plugin implements two key defense mechanisms: Frame protection headers: The plugin adds the X-Frame-Options: SAMEORIGIN and Content-Security-Policy: frame-ancestors 'self' HTTP headers to your site’s pages. They instruct web browsers to prevent other websites from embedding your site within an iframe, effectively blocking clickjacking attempts. A Content-Security-Policy your site already sends is left in place, and WordPress post embeds stay embeddable on other sites. OWASP’s Legacy Browser Frame Breaking Script: The plugin includes a modified version of OWASP’s legacy browser frame breaking script. This script prevents other sites from putting your site in an iframe, even in browsers that don’t support the X-Frame-Options header. The script is optimized to work seamlessly in browsers with and without JavaScript enabled. By combining these two security measures, WP Anti-Clickjack provides comprehensive protection against clickjacking attacks, ensuring the safety and integrity of your WordPress site. For more information about clickjacking defense techniques, refer to the OWASP Clickjacking Defense Cheat Sheet. Features Adds the X-Frame-Options: SAMEORIGIN and Content-Security-Policy: frame-ancestors 'self' HTTP headers to prevent clickjacking Works alongside your existing Content-Security-Policy, including nonce-based policies, and keeps framing headers your server or another plugin already sends Settings > Anti-Clickjack screen to let sites you choose (like your other domains or a partner) frame your site, also available as the wp_anti_clickjack_allowed_origins filter Site Health check that loads your homepage like a visitor and warns if a page cache, CDN or server setting drops or duplicates the headers “Check from outside” button that has ClickJack Test load your homepage from the internet, through your CDN, and shows what it sees “Test your site” link on the Plugins screen Includes a modified version of OWASP’s legacy browser frame breaking script Compatible with popular page builders and editors like Elementor, Divi, WPBakery, Bricks, Breakdance, Oxygen, and more Provides filters to disable the anti-clickjacking measures when needed Easy to install and configure Regularly updated and tested with the latest WordPress versions Additional Details To disable the clickjacking JavaScript, use the following filter in your theme’s functions.php file. It receives true or false and runs last, so you can also return false only on specific pages: add_filter('wp_anti_clickjack', '__return_false'); To disable the clickjacking HTTP headers (X-Frame-Options and Content-Security-Policy: frame-ancestors), use this filter in your theme’s functions.php file: add_filter('wp_anti_clickjack_x_frame_options_header', '__return_false'); To let other sites put your site in a frame, add them under Settings > Anti-Clickjack, one per line. Developers can use this filter instead (it also receives the sites saved in the settings). Wildcards work for subdomains, and the frame breaking script allows the same sites: add_filter( 'wp_anti_clickjack_allowed_origins', function ( $origins ) { $origins[] = 'https://partner.example'; $origins[] = 'https://*.example.com'; return $origins; } ); If your WordPress admin runs on a different domain than your site, that domain is allowed automatically so page builders and previews keep working. Page builder and editor previews are detected only for logged-in users who can edit posts, so a visitor cannot switch the protection off by adding a page builder parameter to a URL. If your server, CDN or another plugin already sends an X-Frame-Options header or a frame-ancestors policy, the plugin leaves them as they are and doesn’t add its own. External services The “Check from outside” button and the “Test your site” link use ClickJack Test, a free clickjacking tester. Nothing is sent unless an administrator clicks one of them. When they do, your homepage address is sent to clickjacktest.com, which requests that address from the internet and reports the framing headers it receives. No other data about your site or its users is sent. See ClickJack Test’s terms of use and privacy policy.
