# WordPress Hardening Options

> GuardPress hardening toggles and defaults: XML-RPC blocking, WP version hiding, disabled file editing and directory browsing, security headers, and more.

- Canonical: <https://royalplugins.com/support/guardpress/wordpress-hardening-options/>
- Last updated: 2026-09-27
- HTML version: <https://royalplugins.com/support/guardpress/wordpress-hardening-options/>

---

The Hardening section of **GuardPress → Settings** is a set of small, independent toggles. Individually they feel minor. Together they close a whole class of enumeration attacks and cheap opportunistic exploitation. This article covers each one: what it changes, what it protects against, and when to leave it off.

### Most hardening options are on by default

Four hardening toggles turn on automatically at plugin activation: XMLRPC brute-force protection, WordPress version hiding, file-editing lockdown (`DISALLOW_FILE_EDIT`), and (via a separate module) the uploads PHP execution block. Security headers, directory-browsing block, and meta-tag removal ship off by default because they benefit from per-site tuning.

## XMLRPC brute-force protection Default ON

The `xmlrpc.php` endpoint is a legacy remote-publishing surface that supports authentication via basic auth without any of the login-form protections. Historically it’s been the target of amplification-style brute-force attacks (one HTTP request can carry hundreds of login attempts via `system.multicall`). GuardPress blocks the endpoint entirely by default. Turn it off only if you actively depend on the old XML-RPC API for a mobile app or a third-party integration; the WordPress REST API is the modern equivalent for most use cases.

## Hide WordPress version Default ON

WordPress ships with a `<meta name="generator">` tag in HTML source and a `?ver=X.Y.Z` query string on core CSS/JS assets. Both leak the WordPress version, which attackers filter for when scanning the internet for installs vulnerable to a known CVE. Removing the version doesn’t make you unhackable; it makes you invisible in mass version-filter scans. Cheap defense with no user-facing cost.

Also worth deleting after every WordPress core update: `/readme.html`, which reveals the exact version in a document Google can index. GuardPress doesn’t auto-delete it (that’s WordPress-core owned), but it’s on the [Pre-Launch Security Checklist](https://royalplugins.com/support/guardpress/pre-launch-security-checklist/) as a manual item.

## Disable file editing Default ON

WordPress ships with a built-in theme and plugin file editor at **Appearance → Theme File Editor** and **Plugins → Plugin File Editor**. The editor lets anyone with the `edit_themes` or `edit_plugins` capability directly modify PHP files served by the site, which means a compromised admin account can drop a webshell into your theme without ever touching SFTP.

This toggle sets `define('DISALLOW_FILE_EDIT', true)` in the loaded config. The editor disappears from the admin menu; direct URLs return 403. Nothing else changes. Leave it on unless you have a specific reason to edit files through wp-admin (there almost never is one; use SFTP or a real deployment pipeline).

## Uploads PHP execution block Default ON

Prevents PHP execution inside `wp-content/uploads/`, shutting down the “upload a .php file via a bad file-type check, then run a shell” attack class. This is a separate module from the rest of Hardening but is default-on for the same reasons. See [Uploads PHP Execution Block Setup](https://royalplugins.com/support/guardpress/uploads-php-execution-block-setup/) for the details and a testing procedure.

## Disable directory browsing Default OFF

If Apache is configured with `Options +Indexes`, visiting a directory without an index file returns a browsable listing of every file in that directory. On WordPress that leaks the plugin list (browsing `/wp-content/plugins/`) and can expose backup files, log files, or private assets that shouldn’t be listed. Nginx doesn’t default to autoindex, so this is Apache-specific.

Enabling this toggle writes `Options -Indexes` to the site’s `.htaccess`. Off by default because most modern hosts already ship this in their server config, but harmless to enable belt-and-suspenders.

## Security headers Default OFF

Response headers that instruct the browser to enforce security policies. GuardPress supports:

- **X-Frame-Options: SAMEORIGIN**: prevents your site from being framed by third parties (clickjacking defense)
- **X-Content-Type-Options: nosniff**: tells the browser not to try to guess a file’s MIME type from its content
- **Strict-Transport-Security** (HSTS): forces future connections to use HTTPS. Set this only after you’re certain HTTPS is working correctly, since a misconfigured HSTS header can lock users out of an HTTP fallback for the duration of the max-age.
- **Referrer-Policy: strict-origin-when-cross-origin**: a sane default for referrer leakage
- **Content-Security-Policy** (CSP): the most impactful header, and the most per-site-tunable. Off by default because a strict CSP will break inline scripts on many themes and plugins. Start with the report-only variant, watch the browser console for a week, then switch to enforce.

All headers are configurable individually. If you use Cloudflare or another CDN with security-header injection, disable them in GuardPress to avoid duplicate headers.

## Remove RSD / WLW / shortlinks meta Default OFF

WordPress adds three legacy meta tags to every page’s HTML head that most sites no longer use:

- **RSD** (Really Simple Discovery): advertises the XML-RPC endpoint to blog-editor apps
- **WLW Manifest**: advertises Windows Live Writer compatibility (Microsoft killed WLW in 2017)
- **Shortlinks**: the `?p=123` shortlink Google didn’t need after permalinks became standard

Removing them is not a security fix, it’s a hygiene fix. Less HTML source noise, smaller attack surface for enumeration tools that scrape metadata. If you disabled the XML-RPC endpoint above, definitely remove the RSD tag too so the source doesn’t advertise an endpoint that doesn’t exist.

Related

- [**Uploads PHP Execution Block Setup**](https://royalplugins.com/support/guardpress/uploads-php-execution-block-setup/): the deep dive on the highest-leverage hardening toggle
- [**Understanding the Security Dashboard**](https://royalplugins.com/support/guardpress/understanding-the-security-dashboard/): the hardening options are one of the score factors
- [**Pre-Launch Security Checklist**](https://royalplugins.com/support/guardpress/pre-launch-security-checklist/): the manual hardening items GuardPress doesn’t automate

[Back to GuardPress Support](https://royalplugins.com/support/guardpress/)
[GuardPress Plugin Page](https://royalplugins.com/guardpress/)