Harden WordPress
Close the doors attackers try first: XML-RPC, user name discovery, the file editors, revealing login errors.
- Turn off XML-RPC Blocks remote publishing, pingbacks and password guessing through xmlrpc.php. The block editor, the REST API and the WordPress apps don’t need it.
- Stop visitors from listing user names Closes the usual ways to find your user names: ?author=1 links, the public users list in the REST API and the users sitemap. Logged-in editors still see authors as usual.
- One message for every failed login The login form says “Wrong username or password” instead of telling a stranger whether a user name exists.
- Turn off the theme and plugin file editors Removes the code editors under Appearance and Plugins, so a stolen admin login can’t be used to write PHP into your theme or plugin files.
- Hide the WordPress version Removes the version number from the page head and feeds, and from the addresses of WordPress’s own scripts and styles.
- Add security headers Sends headers that stop other sites from framing your pages, stop browsers from guessing file types, keep full page addresses private when visitors follow links, and turn off camera, microphone and location access.
- Turn off application passwords Removes application passwords (logins for apps and scripts through the REST API) if you don’t use them.
Move your snippets over this afternoon.
Importing changes nothing until you switch over, and your old shortcodes keep working.