Security
Custom login URL, author enumeration block, REST API restriction, security headers, and update control harden every site
WordPress · Website Toolkit
Replace a Dozen Plugins with One Modular Toolkit
Security hardening. Privacy controls. SEO tweaks. SMTP email. Admin UX improvements. Maintenance mode. Debug tools. All in one panel with risk-aware toggles and zero overhead for disabled modules.
SEO
Attachment page control, archive management, and author sitemap removal eliminate thin content and optimize crawl budget
Content Velocity
Clone posts, drag-and-drop ordering, and Classic Editor support accelerate editorial workflows
Conversion Capturing
SMTP email ensures form notifications and transactional emails actually reach recipients
What it's about
WP PM Site Essentials
Every WordPress site needs a handful of small tweaks: hide the login URL, add security headers, block author enumeration, configure SMTP, enable GZIP, set up maintenance mode. The typical approach is installing ten separate plugins — each with its own settings page, its own updates, and its own potential conflicts.
PM Site Essentials consolidates twenty modules into one plugin with a single settings panel. Every module is an independent toggle. Disabled modules have zero performance overhead — no hooks registered, no code loaded. Risk indicators on each toggle help you understand the impact before enabling.
A one-click "Apply Recommended Baseline" preset handles the most common configuration. JSON import/export replicates settings across multiple sites.
PM Site Essentials is included free of charge with a premotion media managed WordPress hosting agency server — for unlimited WordPress installs.
Features
Thought through to the daily workflow.
Every building block is focused on a clear benefit and fits into existing processes.
Module Section
Custom Login URL *(Medium Risk)* Move the WordPress login page from the default /wp-login.php to a custom slug of your choosing. Bots and automated attacks that target the default URL will get a 404 instead of a login form. Legitimate users bookmark the new URL.
Security Modules
Custom Login URL *(Medium Risk)* Move the WordPress login page from the default /wp-login.php to a custom slug of your choosing. Bots and automated attacks that target the default URL will get a 404 instead of a login form. Legitimate users bookmark the new URL. Author Enumeration Block *(Low Risk)* Prevent discovery of usernames through ?author=N query parameters and /author/ URL patterns. Blocks one of the most common reconnaissance techniques used before brute-force login attempts.
- X-Frame-Options — prevents clickjacking by controlling iframe embedding
- X-Content-Type-Options — prevents MIME-type sniffing attacks
- Referrer-Policy — controls how much referrer information is shared
- Permissions-Policy — restricts access to browser APIs (camera, microphone, geolocation)
- Content-Security-Policy — controls which resources the browser is allowed to load
- WordPress emoji script and styles (loaded on every page by default)
- Generator meta tag (reveals WordPress version)
- REST API link header
- RSS feed links
- DNS prefetch and resource hints
Privacy Modules
Cookie Control *(High Risk)* Three modes for managing cookies across your site: Scope controls let you target specific cookie names, prefixes, or patterns.
- Block All — Prevents all cookies except WordPress session cookies. Nuclear option for maximum privacy.
- Allowlist — Only specified cookies are permitted. Everything else is blocked.
- Blocklist — Only specified cookies are blocked. Everything else is permitted.
SEO Modules
Attachment Page Control *(Low Risk)* Attachment pages are auto-generated WordPress pages for each media file. They typically contain only a single image with no meaningful content. This module redirects attachment pages to the parent post or returns a 404 — preventing thin content from being indexed by search engines. Archive Control *(Low Risk)* Disable or redirect specific archive types individually: - Author archives - Category archives - Tag archives - Date archives
- Author archives
- Category archives
- Tag archives
- Date archives
Email Module
SMTP Configuration *(Low Risk)* Configure WordPress to send emails through an external SMTP server instead of PHP's mail() function. Dramatically improves email deliverability for contact form notifications, password resets, and WooCommerce order emails.
- SMTP host, port, and encryption (TLS/SSL)
- Authentication with username and password
- Custom "From" name and email address
- Test email button for verification
- Credentials stored securely in WordPress database
Admin UX Modules
Classic Editor *(Low Risk)* Restore the TinyMCE Classic Editor. Disable Gutenberg globally or on a per-post-type basis. For sites and teams that prefer the traditional editing experience. Hide Admin Notices *(Low Risk)* Remove the clutter of admin notices from your WordPress dashboard. Plugin promotions, update nags, and non-critical warnings are hidden. A bypass URL parameter lets you view all notices when needed.
Performance Module
GZIP Compression *(Low Risk)* Enable PHP-level gzip output compression for all HTML responses. Reduces transfer size, improving page load times for visitors on slower connections.
Development Modules
Maintenance Mode *(High Risk)* Lock your site behind a password-protected maintenance page. Logged-in administrators bypass the lock automatically. IP whitelist allows specific addresses through without authentication. Essential for site launches, major updates, and migrations. Visitors see a professional maintenance page instead of a broken site.
- On-Page — Errors displayed directly in the browser. Fastest debugging for local development.
- Console — Errors written to the browser console. Less intrusive than on-page display.
- Log File — Errors written to a log file. Best for staging and production troubleshooting.
Tools Section
Apply Recommended Baseline
One-click preset that enables the most commonly useful modules with safe defaults. A fast starting point that handles the basics: security headers, head cleanup, author enumeration block, REST API restriction, and comment cookie removal.
Emergency Disable All
A single button to disable every module at once. If a module configuration causes an issue, this provides immediate recovery without needing to deactivate the plugin.
JSON Import/Export
Export your entire configuration as a JSON file. Import it on another site. Ideal for agencies deploying consistent baselines across client installations or for replicating settings between staging and production.
SMTP Test Email
Send a test email to verify your SMTP configuration is working correctly before relying on it for critical notifications.
Environment Diagnostics
Check the status of: - Permalink structure - REST API availability - GZIP compression status - PHP version and server environment
- Permalink structure
- REST API availability
- GZIP compression status
- PHP version and server environment
How it works
A clear path to the result.
- 01
Step 1 — Install and Activate
PM Site Essentials activates with all modules disabled. Zero performance impact until you enable something.
- 02
Step 2 — Apply Baseline (Optional)
Click "Apply Recommended Baseline" to enable the most common modules with safe defaults. Review what was enabled and adjust.
- 03
Step 3 — Enable Modules
Toggle individual modules from the settings panel. Each module shows a risk indicator (Low, Medium, High) so you understand the impact before enabling. Configure module-specific settings as needed.
- 04
Step 4 — Test
Use the diagnostics tools and test email feature to verify your configuration. The emergency disable button is always available if something unexpected happens.
- 05
Step 5 — Export (Optional)
Export your configuration as JSON and import it on other WordPress installations for consistent settings across sites.
Who is it for?
Made for concrete requirements.
The solution is a particularly good fit for these teams, roles and business models.
Agencies
Deploy consistent security and admin baselines across client sites. Export a JSON configuration once and import it on every new project. No more configuring ten separate plugins on each site.
Site Administrators
Security hardening, privacy controls, and admin improvements in one plugin instead of many. Risk indicators help you understand what each module does before enabling it. The recommended baseline handles the most important tweaks automatically.
Developers
Maintenance mode and debug display make PM Site Essentials essential for development and staging environments. Lock the site during migrations, display errors during debugging, and disable everything when done.
Privacy-Conscious Teams
Cookie control, comment cookie removal, and cookie auto-detection provide granular privacy management. Block cookies site-wide or manage them per-cookie with allowlists and blocklists.
Multi-Site Operators
JSON import/export ensures consistent configuration across all sites in your network. Change the baseline once, export, and deploy everywhere.
Tech & scope
The key details at a glance.
- Version
- 1.1
- WordPress Minimum
- 6.4
- PHP Minimum
- 8.1
- License
- GPL-2.0+
- Data Storage
- Local WordPress database
- Telemetry
- None
- External Dependencies
- None
- Total Modules
- 20
- Module Categories
- 7 (Security, Privacy, SEO, Email, Admin UX, Performance, Development)
- Configuration Export
- JSON
- Author
- premotion media
- Hosting
- Included free with managed WordPress hosting agency server
- Installs
- Unlimited per agency server
FAQ
Frequently asked questions.
Do disabled modules affect performance?
No. Disabled modules register no hooks and load no code. Performance overhead is zero for any module that is not enabled.
What does "risk" mean on each module?
Risk indicates how much the module changes WordPress behavior. Low-risk modules make minor adjustments. Medium-risk modules change visible behavior. High-risk modules (like maintenance mode or cookie blocking) can significantly affect site access or functionality. The risk label helps you make informed decisions.
Can I undo a module's changes?
Yes. Disabling a module reverses its effects. The emergency "Disable All" button turns everything off immediately if needed.
Does the Custom Login URL break login links?
Existing bookmarks and links to /wp-login.php will return a 404 once the custom URL is enabled. Make sure to communicate the new URL to all administrators before enabling this module.
Can I use this with a caching plugin?
Yes. Most modules work independently of caching. GZIP compression should not conflict with caching plugins, but test to confirm if your caching plugin has its own GZIP feature.
How does JSON import/export work?
Export saves all module states and their settings to a JSON file. Import reads a JSON file and applies the configuration. This overwrites current settings, so verify you're importing the correct file.
Is SMTP configuration secure?
SMTP credentials are stored in the WordPress database. The connection supports TLS and SSL encryption. Use the test email button to verify your configuration works before depending on it.
What does the recommended baseline enable?
The baseline enables commonly useful, low-risk modules: security headers, head cleanup, author enumeration block, REST API users restriction, and comment cookie removal. All with safe default settings.
Is this plugin included with premotion media hosting?
Yes. PM Site Essentials is included free with every premotion media managed WordPress hosting agency server. Install it on every WordPress site you manage — no per-site licensing and no add-on fees.
Ready?
One Plugin. Twenty Modules. Zero Bloat.
PM Site Essentials replaces a dozen small plugins with one modular toolkit. Enable what you need, disable what you don't. Risk-aware toggles. Zero overhead for inactive modules. JSON export for consistent deployment. Included free with premotion media managed WordPress hosting.
Discuss your project