Estimated reading time: 7 minutes
If you are reading this you probably already know this. It’s easy to set up a website but it takes work to keep running. Yes, the law of entropy applies to a WordPress website too. Left unattended, things break. Security vulnerabilities go unpatched. Feedback from real users goes uncollected. When something does go wrong, you’re left hunting for a phone number or waiting on an email thread. None of that is good for your business, and none of it has to be your problem.
TL;DR: The Matchbox Support plugin comes free with every support plan. It hardens your WordPress login, locks down publicly exposed site information, embeds a direct support line inside your admin, and collects visual user feedback. It stays updated automatically. Here’s what’s under the hood.
Your Website Has More Exposure Than You Think
WordPress powers over 40% of the web. That popularity is also what makes it the most targeted platform on the internet. Attackers aren’t hand-picking victims; they’re running automated scripts that probe thousands of sites at once, looking for the same predictable weaknesses: a login page that accepts admin as a username, a password that appeared in a data breach, or a public API endpoint that quietly hands over a list of every account on your site. Out of the box, WordPress leaves several of these doors open. The Matchbox Support plugin closes them automatically.
Login Protection
The login page is the most attacked surface on any WordPress site. The plugin hardens it in three ways:
Blocked usernames.
A built-in list of the most commonly guessed usernames (admin, root, test, webmaster, and a dozen others) are blocked at login entirely. Attackers start with these because millions of WordPress sites still use them. Yours won’t.
Blocked common passwords.
The plugin maintains a list of the most frequently used passwords, cross-referenced against known breach data. If someone on your team is logging in with password123 or qwerty, they’ll be prompted to reset before they can get in.
Have I Been Pwned database.
This one is worth explaining because it’s genuinely clever. Every login attempt can be checked in real time against the Have I Been Pwned database, which tracks billions of passwords exposed in data breaches. The check uses a privacy-safe method: only a partial fingerprint of the password is sent over the network, never the password itself. If the password shows up in a known breach, the user is blocked and prompted to reset.
The plugin also removes the “I know my password is weak, use it anyway” bypass checkbox that WordPress shows by default. No more clicking past the warning.
Locking Down Your Site’s Public Information
WordPress makes some information more public than most site owners realize.
By default, anyone who knows where to look can visit a URL like /?author=1 and see your admin’s username. The same goes for the WordPress REST API, which can expose usernames and email addresses to unauthenticated requests. Both of these are standard reconnaissance steps attackers use before attempting a brute-force login.
The plugin automatically returns a 404 on author archive URLs and restricts the REST API so that user information is only available to authenticated users. Your site stops handing out that information for free.
HTTP Security Headers
This is the layer most business owners never see, but browsers see it on every single page load.
HTTP security headers are instructions your website sends to browsers telling them how to behave: force HTTPS only, refuse to load inside an iframe on another site, restrict which scripts are allowed to run, limit access to camera and microphone. The Matchbox Support plugin adds a full suite of these headers to every page your site serves:
| Header | What it does |
|---|---|
| Strict-Transport-Security | Forces browsers to always use HTTPS |
| X-Frame-Options | Prevents your site from being embedded in iframes on other sites (clickjacking protection) |
| X-Content-Type-Options | Stops browsers from guessing file types, which can be exploited |
| Referrer Policy | Controls what URL information is shared when visitors click off your site |
| Permissions Policy | Restricts browser features like camera, microphone, and geolocation |
| Content Security Policy | Controls what resources (scripts, styles, etc.) the browser is allowed to load |
Each header is individually configurable. All defaults are safe, and our team manages the settings as standards evolve.
Support That’s Always One Click Away
Security tools are only half of the equation. When something does come up, you need a fast way to reach your team.
The plugin embeds a HelpScout support beacon directly into your WordPress admin. Administrators and editors see a small help button in the WordPress toolbar at the top of every screen, whether they’re writing a blog post, managing pages, or browsing the front end of the site while logged in.
One click opens a support panel connected directly to the Matchbox team. No searching for a contact page, no digging through old emails for a phone number. The help button is always there, on every screen, for every authorized user on your site.
Feedback That Actually Gets Used
The best signal for improving your website comes from the people using it. The plugin integrates Userback, a visual feedback tool that lets users annotate screenshots and submit reports directly from the browser.
Admins and editors get a feedback toggle in the WordPress toolbar alongside the support beacon. When something looks off, they can trigger the Userback overlay from any page, draw directly on the screen, add a note, and submit. The report arrives with a screenshot and full context attached so our team knows exactly what was seen and where.
For sites in active client review, the feedback widget can also be enabled for logged-out visitors, making it easy for stakeholders to flag issues during review without needing a login.
Maintained So You Don’t Have To Think About It
A security plugin that doesn’t get updated becomes a liability faster than having no plugin at all. The Matchbox Support plugin is actively maintained and pushed to client sites through the standard WordPress update flow automatically.
As WordPress evolves, as new vulnerabilities are disclosed, and as browser security standards change, the plugin is updated to keep pace. Support plan customers get those updates at no additional cost and with no action required on their end. It just stays current.
The Bottom Line
A website support plan is only as good as the infrastructure behind it. The Matchbox Support plugin is what makes real, responsive support possible: a hardened security posture from day one, a direct line to our team from inside your WordPress admin, and a frictionless way to capture feedback from the people actually using your site.
If you’re already on a Matchbox support plan, this plugin is already working for you. If you’re not yet on a plan, get in touch and we’ll walk you through what’s included.
Key Takeaways
- WordPress powers over 40% of the web, making it the most targeted platform for automated attacks that probe for common weaknesses.
- The Matchbox Support plugin comes free with every support plan and hardens login security by blocking common usernames, breached passwords, and brute-force attempts.
- It locks down publicly exposed site information, like author archive URLs and REST API data, that attackers use for reconnaissance.
- A full suite of HTTP security headers is added to every page, protecting against clickjacking, MIME-sniffing, and other browser-level exploits.
- Built-in HelpScout support and Userback feedback tools give admins a direct line to the Matchbox team and capture real visual feedback from users.
- The plugin updates automatically, so security stays current with no extra cost or action required from site owners.
FAQs
No. If you’re on a Matchbox support plan, the plugin is already installed and configured on your site. There’s nothing for you to set up or maintain — updates and configuration happen on our end.
No. The checks happen at login and in the HTTP headers — both add basically zero overhead, since they’re just inspecting requests as they pass through, not running heavy scans in the background. Your page speed doesn’t move.
We do not offer this as a standalone service and is only offered as a support plan perk, Want it? Get in touch and we’ll walk you through what’s included, what it costs, and how quickly we can get it running on your site.
Yes. Every header’s configurable on its own, so if a third-party embed, script, or integration needs a specific exception, we don’t have to choose between it working and your site staying protected. We adjust the header to fit your case rather than switching off protection entirely.
No. Backups run separately as part of your support plan, on their own schedule and storage. This plugin’s job is security, exposure prevention, and feedback — keeping backups as a distinct piece means one issue with either doesn’t put the other at risk.
