內容簡介
Hopelessly Sensible 是一款簡單的安全強化外掛，專為不喜歡複雜安全設定的使用者設計。它提供七項安全功能，並以簡單明瞭的方式說明每項功能的作用，讓使用者能輕鬆保護網站安全。
【主要功能】
• 隱藏使用者列表與用戶名
• 統一登入失敗訊息
• 隱藏作者頁面與網站地圖
• 阻擋 XML-RPC 接口
• 關閉所有評論功能
• 鎖定佈景主題與外掛編輯器
外掛標籤
開發者團隊
② 後台搜尋「Hopelessly Sensible: Simple Security Hardening」→ 直接安裝（推薦）
原文外掛簡介
Most security plugins are built for people who enjoy security. This one is built for everyone else: the person who looks after a small charity’s website on a Tuesday evening and would like to stop worrying about it.
It does seven things. Each one has a switch, a plain-English explanation of what it does, and an honest note about what it might break. No notification badges, no upgrade prompts, no counting of attacks repelled, and nothing anywhere in your dashboard trying to sell you something.
It describes your site as it is today.
Everything on the settings screen is about your site now, not about what it looked like the day you installed this. If four people publish posts here, it says four. If three comments are approved and hidden from your visitors, it says so, and tells you how to get rid of them for good if that is what you want.
It sets up what is safe, and leaves the rest to you.
When you activate it, the plugin looks at your site and switches on what is safe here. If you have one writer, it hides author pages. If nobody has approved a comment in a year, it closes comments. Three of the seven are never switched on for you, because they take something away from you rather than from a visitor, and that decision is yours to make.
If something changes, it stands down and tells you.
If a setting stops being safe to leave on, this plugin switches it off by itself. Install something that needs remote publishing and blocking remote publishing goes off, rather than sitting there reading as on while quietly breaking your new plugin. When that happens you get one notice, once, saying what changed and why, and you can dismiss it for good. It is the only thing this plugin will ever show you outside its own settings screen, and it only ever appears because something has already happened.
A switch that is off is never turned on behind your back. That direction is always yours.
What it does
Keeps your list of users and their usernames away from anonymous visitors
Gives the same short message whether a login failed on the username or the password
Hides author pages, and keeps writers out of your sitemap and link previews
Blocks XML-RPC, an old remote publishing interface popular with password-guessing tools
Closes comments everywhere, and leaves WooCommerce reviews alone unless you say otherwise
Closes WooCommerce product reviews, if you want that
Locks the theme and plugin file editors in the dashboard
Warns you if you have a user called “admin”, and does nothing else about it
What it does not do
It does not write to your .htaccess file, your wp-config.php, or anything outside its own single settings row. Deactivate it and your site is exactly as it was, immediately.
It adds no JavaScript to your dashboard.
It does not scan, does not phone home, does not collect anything, and has no paid version.
It does not give you homework. There is no checklist, no score, and no red badge waiting for you.
It does not hide options from you. Anything this plugin cannot do on your site is still on the screen, switched off, saying what is stopping it.
Free and open source, GPL, written by Hebble & Stone, a community interest company that builds websites for charities.
