WordPress hardening & self-defense
Close the doors WordPress leaves open (file editors, XML-RPC, user enumeration, version leaks), protect your content from scraping, and let the security plugin defend itself against being switched off.
Every toggle ships off by default: you harden deliberately, not by surprise.
Hardening toggles
Each toggle is one decision, documented and reversible: disable the built-in file editors, block code execution in the uploads folder, stop user enumeration and login-error hints, hide the WordPress version, switch off XML-RPC or the REST API, strip the X-Powered-By header, add security headers, block common attack usernames, disable directory browsing and open registration.
API privacy filtering runs alongside, trimming what your REST API reveals to anonymous visitors.
Content protection
For sites whose content is the product, a separate module deters casual copying: disable right-click, text selection, copy/cut, image dragging, printing and view-source shortcuts, add image overlays and hotlink protection, scoped to the whole site or specific pages, with your choice of visitor notification. Honest framing: this deters casual scraping, not a determined engineer.
Self-defense
The first thing many attackers do after gaining admin access is deactivate the security plugin. With self-defense on, deactivation demands re-authentication (password or passkey), every deactivation attempt is logged at critical severity with user and IP and fires an alert, and the plugin verifies its own main file's hash to detect tampering.
- Re-authentication (password or passkey) required to deactivate
- Deactivation attempts logged as critical, with alerting
- Main plugin file hash verification against tampering
Documentation
Hardening questions
Can hardening break my site?
Some toggles (disabling REST or XML-RPC) can affect plugins that depend on them. Everything defaults to off, changes are individually reversible, and Test Mode lets you simulate first.
Does content protection actually stop copying?
It deters casual copying and scraping. Anyone with developer tools and determination can get around client-side protection. We say so plainly rather than overselling it.
What stops an attacker just deactivating the plugin?
Self-defense: deactivation requires re-authentication, the attempt is logged at critical severity with the user and IP, and an alert fires immediately.
Related features
Secure your site today
Install the free plugin from WordPress.org and set up real protection with the guided setup wizard. Upgrade to Pro whenever you need more.