WordPress Hardening Options

XMLRPC brute-force protection Default ON

The xmlrpc.php endpoint is a legacy remote-publishing surface that supports authentication via basic auth without any of the login-form protections. Historically it’s been the target of amplification-style brute-force attacks (one HTTP request can carry hundreds of login attempts via system.multicall). GuardPress blocks the endpoint entirely by default. Turn it off only if you actively depend on the old XML-RPC API for a mobile app or a third-party integration; the WordPress REST API is the modern equivalent for most use cases.

Hide WordPress version Default ON

WordPress ships with a <meta name="generator"> tag in HTML source and a ?ver=X.Y.Z query string on core CSS/JS assets. Both leak the WordPress version, which attackers filter for when scanning the internet for installs vulnerable to a known CVE. Removing the version doesn’t make you unhackable; it makes you invisible in mass version-filter scans. Cheap defense with no user-facing cost.

Also worth deleting after every WordPress core update: /readme.html, which reveals the exact version in a document Google can index. GuardPress doesn’t auto-delete it (that’s WordPress-core owned), but it’s on the Pre-Launch Security Checklist as a manual item.

Disable file editing Default ON

WordPress ships with a built-in theme and plugin file editor at Appearance → Theme File Editor and Plugins → Plugin File Editor. The editor lets anyone with the edit_themes or edit_plugins capability directly modify PHP files served by the site, which means a compromised admin account can drop a webshell into your theme without ever touching SFTP.

This toggle sets define('DISALLOW_FILE_EDIT', true) in the loaded config. The editor disappears from the admin menu; direct URLs return 403. Nothing else changes. Leave it on unless you have a specific reason to edit files through wp-admin (there almost never is one; use SFTP or a real deployment pipeline).

Uploads PHP execution block Default ON

Prevents PHP execution inside wp-content/uploads/, shutting down the “upload a .php file via a bad file-type check, then run a shell” attack class. This is a separate module from the rest of Hardening but is default-on for the same reasons. See Uploads PHP Execution Block Setup for the details and a testing procedure.

Disable directory browsing Default OFF

If Apache is configured with Options +Indexes, visiting a directory without an index file returns a browsable listing of every file in that directory. On WordPress that leaks the plugin list (browsing /wp-content/plugins/) and can expose backup files, log files, or private assets that shouldn’t be listed. Nginx doesn’t default to autoindex, so this is Apache-specific.

Enabling this toggle writes Options -Indexes to the site’s .htaccess. Off by default because most modern hosts already ship this in their server config, but harmless to enable belt-and-suspenders.

Security headers Default OFF

Response headers that instruct the browser to enforce security policies. GuardPress supports:

• X-Frame-Options: SAMEORIGIN: prevents your site from being framed by third parties (clickjacking defense)
• X-Content-Type-Options: nosniff: tells the browser not to try to guess a file’s MIME type from its content
• Strict-Transport-Security (HSTS): forces future connections to use HTTPS. Set this only after you’re certain HTTPS is working correctly, since a misconfigured HSTS header can lock users out of an HTTP fallback for the duration of the max-age.
• Referrer-Policy: strict-origin-when-cross-origin: a sane default for referrer leakage
• Content-Security-Policy (CSP): the most impactful header, and the most per-site-tunable. Off by default because a strict CSP will break inline scripts on many themes and plugins. Start with the report-only variant, watch the browser console for a week, then switch to enforce.

All headers are configurable individually. If you use Cloudflare or another CDN with security-header injection, disable them in GuardPress to avoid duplicate headers.

Remove RSD / WLW / shortlinks meta Default OFF

WordPress adds three legacy meta tags to every page’s HTML head that most sites no longer use:

• RSD (Really Simple Discovery): advertises the XML-RPC endpoint to blog-editor apps
• WLW Manifest: advertises Windows Live Writer compatibility (Microsoft killed WLW in 2017)
• Shortlinks: the ?p=123 shortlink Google didn’t need after permalinks became standard

Removing them is not a security fix, it’s a hygiene fix. Less HTML source noise, smaller attack surface for enumeration tools that scrape metadata. If you disabled the XML-RPC endpoint above, definitely remove the RSD tag too so the source doesn’t advertise an endpoint that doesn’t exist.