General Hardening Snippets

WordPress powers a huge share of the web, which makes it a constant target for automated scanners working through a checklist of things that are true on almost every out-of-the-box install: XML-RPC is enabled, the theme and plugin file editor is reachable from wp-admin, and the exact WordPress version number is broadcast in the page source for anyone deciding whether your site is worth targeting further. Most attacks against WordPress sites aren't sophisticated — they're bots running through that same checklist at scale, not attackers manually studying your specific setup.

The snippets in this category close off that checklist one default at a time. Each one targets a single, specific setting that has a real, documented history of abuse, using the exact filter, action, or constant WordPress exposes for turning that default off — not vague "best practice" advice with no concrete implementation. People land in this category after a security plugin flags a warning they don't fully understand, after reading a hardening checklist and wanting to apply it without installing yet another plugin, or after a scare — a hacked site, a suspicious login, a hosting provider's abuse notice — that made security suddenly urgent.

None of these snippets require deep PHP knowledge to apply safely, but they do change how WordPress core behaves by default, so treat them the same way you'd treat any change to a production site: test on staging first if you have it, apply one snippet at a time so you can tell what changed if something breaks, and know how to remove a snippet before you add it.

New to editing WordPress code? Read our guide on how to safely add code snippets before using any of the ones below.