Title: Hopelessly Sensible: Simple Security Hardening
Author: Hebble & Stone CIC
Published: <strong>September 11, 2026</strong>
Last modified: September 14, 2026

---

Search plugins

![](https://ps.w.org/hopelessly-sensible/assets/banner-772x250.png?rev=3690973)

![](https://ps.w.org/hopelessly-sensible/assets/icon-256x256.png?rev=3690973)

# Hopelessly Sensible: Simple Security Hardening

 By [Hebble & Stone CIC](https://profiles.wordpress.org/hebblestone/)

[Download](https://downloads.wordpress.org/plugin/hopelessly-sensible.1.1.1.zip)

 * [Details](https://vec.wordpress.org/plugins/hopelessly-sensible/#description)
 * [Reviews](https://vec.wordpress.org/plugins/hopelessly-sensible/#reviews)
 * [Development](https://vec.wordpress.org/plugins/hopelessly-sensible/#developers)

 [Support](https://wordpress.org/support/plugin/hopelessly-sensible/)

## Description

Most WordPress security plugins are heavy and slow. This one is simple, light and
reliable.

It does seven things. Each one has a switch, a plain-English explanation of what
it does and an honest note about what it might break. No notification badges, no
upgrade banners and nothing in your dashboard trying to sell you something.

**It sets up what is safe and leaves you in charge**

When you activate it, Hopelessly Sensible looks at your site and switches on everything
that is safe here. Protections that take a feature away from you are left off, so
that call stays yours.

**If something changes, it stands down and tells you**

If a setting stops being safe to leave on, this plugin switches it off by itself
and gives you one clear, dismissible notice saying what changed and why. It is the
only thing this plugin ever shows you outside its own settings screen. A switch 
that is off is never turned on behind your back.

**What it does**

 * Keeps your list of users and their usernames away from anonymous visitors
 * Gives the same short message whether a login failed due to the username or the
   password
 * Hides author pages and keeps writers out of your sitemap and link previews
 * Blocks XML-RPC, an old remote publishing interface popular with password-guessing
   tools
 * Optionally: closes comments everywhere
 * Optionally: closes WooCommerce product reviews
 * Optionally: locks the theme and plugin file editors in the dashboard
 * Warns you if you have a user called “admin”, and explains how to fix it

**What it does not do**

 * It does not write to your .htaccess file, your wp-config.php or anything outside
   its own single settings row. Deactivate it and your site is exactly as it was,
   immediately.
 * It adds no JavaScript to your dashboard.
 * It does not scan, does not phone home, does not collect any data and has no paid
   version.
 * It does not give you homework. There is no checklist, no score and no red badge
   waiting for you.
 * It does not hide options from you. Anything this plugin cannot do on your site
   is still on the screen, switched off, saying what is stopping it.

Free and open source, GPL, written by Hebble & Stone, a community interest company
that builds websites for charities, organisations and small businesses.

## Screenshots

[⌊The settings screen. Every option carries a plain explanation and a note on what
it might break.⌉⌊The settings screen. Every option carries a plain explanation and
a note on what it might break.⌉[

The settings screen. Every option carries a plain explanation and a note on what
it might break.

[⌊An option this site cannot use, still on the screen, saying what is stopping it.⌉⌊
An option this site cannot use, still on the screen, saying what is stopping it.⌉[

An option this site cannot use, still on the screen, saying what is stopping it.

## FAQ

### Will this break my site?

Very unlikely, but each setting changes how something works and carries a warning
saying what. If something surprises you, switch it back off and your site is as 
it was.

### What happens if I deactivate it?

Everything goes back to how it was, straight away. The plugin makes no permanent
changes to your site, so there is nothing to undo. Uninstalling removes its single
row from your options table.

### Does it work with WooCommerce?

Yes, and carefully. WooCommerce reviews are stored as comments, so closing comments
would ordinarily take your product reviews and star ratings with them. This plugin
never does that. Reviews have their own option, off by default, and it stays on 
the screen with an explanation even when WooCommerce is not installed. Order notes,
which are also stored as comments, are never touched by anything here.

One thing to know if your shop is running an old WooCommerce. Closing comments takes
the Comments screen out of your dashboard, and WooCommerce moved review moderation
to its own screen under Products in version 6.7. On WooCommerce 6.7 or later this
is fine, and you carry on approving reviews as normal. On anything older, reviews
are still moderated on the Comments screen, so this plugin leaves that screen reachable
on those shops rather than taking review moderation away from you.

### Does it work on multisite?

Yes, but activate it on each site rather than across the whole network. Activating
for the network means it cannot look at your sites one by one, so every option is
off by default and it says so on the settings screen. Activated site by site, it
looks at each one properly. Either way the settings are per site, so what you choose
on one site does not affect another.

### Will it stop someone hacking my site?

No plugin can promise that and you should be wary of any that implies it. This one
closes off a set of well-known ways that automated tools and bots gather information
and guess passwords. That is worth doing, though it is not the same thing as being
safe. Strong passwords, two-factor authentication and keeping WordPress and its 
plugins updated matter more than anything.

### Why is there no scanning, firewall or login limiting?

Because those need attention and this plugin is set and forget. Features that generate
alerts generate work, work gets ignored and ignored alerts are worse than no alerts.

### I have a user called “admin” and it is warning me. What do I do?

WordPress does not let you rename a user. The usual route is to create a second 
administrator account with a different username, log in as that one, delete the “
admin” account and hand its posts over to the new account when WordPress asks.

## Reviews

![](https://secure.gravatar.com/avatar/f4083af61daf2e4a2dbb805650d7fd29e178f72ee86e1ba7b8f3a9ed7468e63b?
s=60&d=retro&r=g)

### 󠀁[Finally, thank you](https://wordpress.org/support/topic/finally-thank-you-3/)󠁿

 [ulimc](https://profiles.wordpress.org/ulimc/) September 11, 2026

It seems very lightweight and doing its job. Will surely use it on my projects to
replace some of the more bulky ones.BONUS: "No notification badges, no upgrade prompts"
<– this is gold, i am usually frustrated by this on plugins, so THANK YOU.

 [ Read all 1 review ](https://wordpress.org/support/plugin/hopelessly-sensible/reviews/)

## Contributors & Developers

“Hopelessly Sensible: Simple Security Hardening” is open source software. The following
people have contributed to this plugin.

Contributors

 *   [ Hebble & Stone CIC ](https://profiles.wordpress.org/hebblestone/)
 *   [ Matt Bedford ](https://profiles.wordpress.org/mattbedford/)

[Translate “Hopelessly Sensible: Simple Security Hardening” into your language.](https://translate.wordpress.org/projects/wp-plugins/hopelessly-sensible)

### Interested in development?

[Browse the code](https://plugins.trac.wordpress.org/browser/hopelessly-sensible/),
check out the [SVN repository](https://plugins.svn.wordpress.org/hopelessly-sensible/),
or subscribe to the [development log](https://plugins.trac.wordpress.org/log/hopelessly-sensible/)
by [RSS](https://plugins.trac.wordpress.org/log/hopelessly-sensible/?limit=100&mode=stop_on_copy&format=rss).

## Changelog

#### 1.1.1

 * Changed: three messages borrowed from WordPress itself (the vague login error,
   the remote publishing refusal and the user list refusal) are now translatable
   as part of this plugin, as the plugin directory requires, rather than inheriting
   the translations WordPress ships with.

#### 1.1.0

 * Fixed: on WordPress 7.1, “Block remote publishing” could not be switched on at
   all, and switched itself off on sites that had it on. WordPress 7.1 began using
   the same hook this plugin watches to work out whether anything on your site needs
   remote publishing, and the plugin read that as your site needing it.
 * Added: “Lock the file editor” is now blocked, with an explanation, on sites where
   a published GeneratePress element runs PHP. GeneratePress stops running that 
   code while the editor is locked, and prints the code into the page instead.
 * Changed: the warning under “Lock the file editor” now mentions code snippets 
   plugins, some of which stop running their code when the editor is locked.
 * Tested against WordPress 7.1.

#### 1.0.0

 * First release.

## Meta

 *  Version **1.1.1**
 *  Last updated **4 weeks ago**
 *  Active installations **10+**
 *  WordPress version ** 6.5 or higher **
 *  Tested up to **7.1.3**
 *  PHP version ** 7.4 or higher **
 *  Language
 * [English (US)](https://wordpress.org/plugins/hopelessly-sensible/)
 * Tags
 * [comments](https://vec.wordpress.org/plugins/tags/comments/)[hardening](https://vec.wordpress.org/plugins/tags/hardening/)
   [privacy](https://vec.wordpress.org/plugins/tags/privacy/)[security](https://vec.wordpress.org/plugins/tags/security/)
   [xmlrpc](https://vec.wordpress.org/plugins/tags/xmlrpc/)
 *  [Advanced View](https://vec.wordpress.org/plugins/hopelessly-sensible/advanced/)

## Ratings

 5 out of 5 stars.

 *  [  1 5-star review     ](https://wordpress.org/support/plugin/hopelessly-sensible/reviews/?filter=5)
 *  [  0 4-star reviews     ](https://wordpress.org/support/plugin/hopelessly-sensible/reviews/?filter=4)
 *  [  0 3-star reviews     ](https://wordpress.org/support/plugin/hopelessly-sensible/reviews/?filter=3)
 *  [  0 2-star reviews     ](https://wordpress.org/support/plugin/hopelessly-sensible/reviews/?filter=2)
 *  [  0 1-star reviews     ](https://wordpress.org/support/plugin/hopelessly-sensible/reviews/?filter=1)

[Your review](https://wordpress.org/support/plugin/hopelessly-sensible/reviews/#new-post)

[See all reviews](https://wordpress.org/support/plugin/hopelessly-sensible/reviews/)

## Contributors

 *   [ Hebble & Stone CIC ](https://profiles.wordpress.org/hebblestone/)
 *   [ Matt Bedford ](https://profiles.wordpress.org/mattbedford/)

## Support

Got something to say? Need help?

 [View support forum](https://wordpress.org/support/plugin/hopelessly-sensible/)