WPDeeply
WordPress Hardening
Configuration changes that reduce WordPress attack surface.
Hardening does not stop a vulnerability being a vulnerability. It limits what an attacker reaches once they find one, and it makes the cleanup smaller.
Guides
- The WordPress security checklist
- Securing wp-config.php
- WordPress file permissions, correctly
- Protecting wp-admin and wp-login
- Security headers worth setting
Setting DISALLOW_FILE_EDIT costs nothing and removes one of the most common post-compromise persistence routes: the built-in theme and plugin editor.