A small collection of single-purpose WordPress must-use plugins - each one file, no settings, no dependencies.
Must-use plugins load automatically from wp-content/mu-plugins/, before regular plugins, with
no activation step and no way to deactivate them from the admin. That makes them a good fit for
small, always-on fixes you want to be sure are running.
Copy the file you want into your site's wp-content/mu-plugins/ directory (create the folder if
it does not exist). That's it - it is active immediately. To remove one, delete the file. None of
these store options or database tables, so removal is clean.
Publishes any post stuck in future past its scheduled time. WordPress publishes a scheduled
post through a single one-shot publish_future_post event and has no fallback, so if that event
is ever lost the post can sit unpublished indefinitely. This runs a small sweep on every cron
run and publishes anything overdue. It hooks wp_loaded and gates on wp_doing_cron(), so it
rides the physical cron trigger and does not depend on any stored event surviving. Requires a
working cron (WP-Cron or a real server cron hitting wp-cron.php).
Blocks the two common public user-enumeration vectors so login usernames stay private: numeric
?author=N scans (which core would redirect to /author/<slug>/) and the anonymous REST
/wp/v2/users endpoint. Logged-in requests - the editor and other authenticated tools - are
left untouched.
GPL-2.0-or-later. Use at your own risk; test on staging first.