WordPress hardening in one clear checklist

What WordPress hardening means

Every way into a site is something you have to defend. WordPress includes old remote controls, code editors and information leaks that most sites never need. Hardening is the job of switching those off, so there is less for an attacker to try and less for them to learn about you.

It is one of the cheapest security steps there is. It will not stop an attacker who already has a valid password, which is why it belongs next to login protection, two-factor and a password policy rather than instead of them.

The WordPress hardening switches in Stack Guard

Everything lives on the Hardening tab, grouped by what it closes. Each switch has plain-language help beside it, and the ones that can affect how your site behaves carry a warning.

• Disable XML-RPC: an old remote control for WordPress where one request can try hundreds of passwords. Stack Guard refuses every XML-RPC request. Free.
• Disable pingbacks and trackbacks: stops other sites sending automatic link notices and stops yours sending them, which are mostly used for spam. Free.
• Disable comments site wide: closes comments on every post type and removes the Comments screens. Free. Delete All Comments is Pro, permanent, and best done after a backup.
• Disable application passwords: they let apps sign in without the normal sign-in page and they skip two-factor. Pro.
• Disable theme and plugin editors: removes the screens where an administrator can edit code from the browser, and blocks them if visited directly. Free.
• Block user enumeration and hide the WordPress version: visitors who are not signed in can no longer read usernames from author lookups or the REST API, and the version number disappears from page code and file links. Free.
• Admin over HTTPS: a read-only check that your admin area and sign-in page are served securely.

Rotate your WordPress security keys

Your wp-config.php file holds eight long random keys, often called salts. WordPress uses them to sign the cookies that keep people signed in. Change them and every existing sign-in stops working at once, including any an attacker stole. After a break-in, a leaked backup or a departing developer, it is the fastest way to throw everyone out.

Rotate Now and email reminders are in every plan. Pro adds automatic rotation daily, weekly or monthly at a time you choose, so pick a quiet hour. Before writing, Stack Guard saves a copy of wp-config.php (the last 3 are kept) and checks the new file is valid. If wp-config.php is not writable, ask your host or use reminders and change the keys by hand.

A safe order for WordPress hardening

Start with the low-risk switches: the code editors, user enumeration, the WordPress version and pingbacks. Then look at the ones that can break something. Keep XML-RPC on if you use the old WordPress mobile app, Jetpack or a service that publishes through it, and leave application passwords on if an app signs in with one. Stack Guard's compatibility check warns you about Jetpack.

On sites that use plain page addresses such as ?p=123, author archive pages stop working for visitors once enumeration is blocked. Signed-in users are not affected, so the block editor keeps working.

Change one thing at a time and test the site after each. Pair user enumeration blocking with Hide Login Error Details on the Login tab, so the sign-in page stops revealing usernames too.