Hardening

WordPress ships with every feature enabled so that any kind of site can work: feeds, XML-RPC, pingbacks, public REST API, user listings, emoji scripts. A blog wants some of those. A membership site wants almost none of them, and each one it doesn't want is a door left open.

The Hardening module is a wall of toggles that close those doors, one at a time. There's no scanner, no definitions database, nothing to update. Each switch turns off a WordPress feature or adds a security header, and together they shrink the amount of your site an attacker can even see.

Everything is opt-in and reversible. Most toggles are safe on any membership site; a handful (marked in the admin as high impact) can break integrations, so they carry a short warning and an honest list of what they'll take down with them.

The settings are grouped the way attackers group them:

• Login and authentication makes it harder to harvest usernames and brute-force passwords.
• REST API controls decide how much of your site's data is reachable without logging in.
• XML-RPC controls shut down WordPress's oldest remote-access back door, in steps.
• Information disclosure removes the version numbers and links that fingerprint your site as WordPress.
• Kill switches turn entire features off outright: comments, feeds, embeds, sitemaps.
• Security headers tell browsers to enforce rules your server can't.
• Admin cleanup removes distractions and buttons your editors should never see.

Start with the recommended baseline if you want the short version of what to enable today, or read what hardening means compared to a firewall before you begin.