How to Use the Security Tab in Classic Monks: Feature Index

Last updated on August 7, 2026

Key Takeaways

• 39 per-feature docs covering the full Security tab

• 5 subtabs: WP Protection, Two-Factor Auth, Content Protection, Stay Logged In, Staging Protection

• Each feature has its own dedicated guide with frontmatter, FAQ, and advanced developer options

• Defense-in-depth: features are designed to be combined (e.g., Custom Login URL + Login Lockdown + Turnstile)

WP Protection

The WP Protection subtab is the broadest, covering login security, captcha, and server hardening. 13 features.

Feature	Description	Guide
Use a Custom Login URL	Change `/wp-login.php` to a custom slug. 3 sub-options.	View guide
Enable Login Lockdown	Lock out users after failed attempts. 9 sub-options including extended lockout.	View guide
Use Cloudflare Turnstile	Add privacy-first captcha. 6 sub-options.	View guide
Use Math Captcha	Add self-contained math captcha. 4 sub-options.	View guide
Use Auto Logout	Auto-logout after configurable idle time. 1 sub-option.	View guide
Email and Phone Protection	Cloak emails and phone numbers from scrapers. 4 sub-options.	View guide
Remove REST API Links	Remove the API discovery link tag.	View guide
Disable User Enumeration	Block user enumeration attacks.	View guide
Hide Remember Me Checkbox	Force session expiry at browser close.	View guide
Disable .htaccess File Access	Block HTTP access to .htaccess.	View guide
Disallow File Modifications	Disable file edits via admin.	View guide
Disable XML-RPC	Block the legacy XML-RPC endpoint.	View guide

The Two-Factor Auth subtab adds TOTP and Email OTP support. 4 features.

Feature	Description	Guide
TOTP 2FA	Time-based One-Time Password via authenticator app.	View guide
Email OTP 2FA	Email-based one-time password.	View guide
Allow Trusted Devices	Skip 2FA on trusted devices for a configurable period.	View guide
Enable 2FA Rate Limiting	Lock out users after failed 2FA attempts. 3 sub-options.	View guide

The Content Protection subtab protects content from unauthorized access and casual copying. 15 features.

Feature	Description	Guide
Site-Wide Password Protection	Require a password for any visitor. 1 sub-option (IP whitelist).	View guide
Block AI Crawlers	Block 10+ major AI training crawlers.	View guide
Spam Comment and Review Protection	Multi-layer spam detection for comments and reviews.	View guide
Restrict Editor Access	Limit editors to their own posts.	View guide
Disable Text Selection	Prevent text selection on the frontend. 4 sub-options.	View guide
Disable Right Click	Disable the right-click context menu.	View guide
Disable View Source	Block the CTRL+U shortcut.	View guide
Disable Inspect Element	Block the F12 shortcut.	View guide
Disable Copy/Cut/Paste	Block CTRL+C/X/V shortcuts.	View guide
Disable Select All	Block the CTRL+A shortcut.	View guide
Disable Save	Block the CTRL+S shortcut.	View guide
Disable Print	Block the CTRL+P shortcut.	View guide
Disable Image Drag	Prevent dragging images to the desktop.	View guide
Disable Safari Reader Mode	Prevent Safari from offering Reader Mode.	View guide
Apply to Administrators	Master switch to apply content protection to admins.	View guide

The Stay Logged In subtab extends auth cookie duration. 2 features.

Feature	Description	Guide
Enable Stay Logged In	Extend auth cookie to 30 days.	View guide
Auto-check Remember Me	Pre-check the Remember Me checkbox.	View guide

The Staging Protection subtab locks down staging and development sites. 5 features.

Feature	Description	Guide
Enable Staging Protection	Master toggle for staging safety.	View guide
Enable HTTP Authentication	Browser-level password prompt.	View guide
Allow Performance Testing Tools	Whitelist for GTmetrix, Pingdom, etc.	View guide
Allow Development Endpoints	Allow access to dev endpoints (WP_DEBUG, etc.).	View guide
Show Staging Environment Indicator	Visible banner in admin.	View guide

Maximum login security: Custom Login URL + Login Lockdown + Cloudflare Turnstile + Hide Remember Me
Mandatory 2FA for admins: TOTP 2FA + Trusted Devices + Rate Limiting (require for admin role)
Staging site lockdown: Staging Protection + HTTP Authentication + Staging Indicator
Premium content protection: Site-Wide Password + Text Selection + Disable Copy/Paste
Spam-free blog: Spam Comment Protection + Math Captcha + Disable User Enumeration