WordPress Hardening, XML-RPC and REST

Real attack surface, closed properly, without breaking what works.

Hardening and Site Configuration: Closing Attack Surface Without Touching How Your Site Works

A lot of common WordPress compromise routes have nothing to do with any single plugin, an execution flaw in an upload folder, an XML-RPC method built decades ago for a different threat model, a REST endpoint that hands out usernames to anyone who asks. These close the well-documented ones properly, without breaking the things you actually need working.

Key Features

XML-RPC Hardening

Removes the specific pingback and multicall methods actually abused for amplification and DDoS relay attacks, while leaving legitimate XML-RPC use, like the WordPress mobile app, completely untouched.

REST API Hardening

Stops /wp-json/wp/v2/users from listing accounts to logged-out requests, closing a common reconnaissance step used before a credential-stuffing attack even starts.

Upload Folder Execution Hardening

Blocks PHP files from ever running inside wp-content/uploads/, one of the most common real-world compromise routes there is. On by default.

Security Headers

Sends X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and Permissions-Policy by default, with Content-Security-Policy available if you want to configure it yourself.

security.txt Generator

Serves a standard, RFC-compliant security.txt file automatically at /.well-known/security.txt, so a genuine security researcher who finds something knows exactly how to reach you.

Login URL Hiding

Moves the login page off the default address. Off by default, since it's the highest lockout-risk feature here, it checks for slug collisions with real pages before saving, and respects the emergency bypass.

Attack surface closed, nothing you actually use gets broken

Get free access Get free access Get free access

Hardening & Site Configuration

Every claim checked against a real site