Poet Farmer

PF Secure Toolkit helps you secure your site by turning off WordPress components you may not need or want exposed.
Features include: 
* Disable Author Archives (301 redirect + remove users sitemap). 
* Disable Comments site-wide (removes UI, blocks REST, hides existing). 
* Disable WP Emojis (scripts, styles, TinyMCE, email/RSS, CDN prefetch). 
* Disable XML-RPC (removes headers, blocks pingback methods). 
* Quick toggle settings in the admin panel.

PF Secure Toolkit

PF Secure Toolkit is a lightweight, modular plugin to harden WordPress by disabling unnecessary features.

Marc Armengou

Security Hardener is inspired by the official WordPress hardening guide (Advanced Administration / Security / Hardening). It uses the platform’s standard functions and does not override core. Applies a prudent set of defenses:
<ul>
<li>Security headers: <code>X-Frame-Options</code>, <code>X-Content-Type-Options</code>, <code>Referrer-Policy</code>, <code>Permissions-Policy</code>, <code>COOP/CORP</code>. </li>
<li>HSTS (optional; HTTPS only). </li>
<li>Basic nonce-based CSP (optional; requires testing). </li>
<li>Disable XML-RPC and pingbacks (optional; enabled by default). </li>
<li>Hide the WordPress version in the <code><head></code>. </li>
<li>Block user enumeration via <code>/?author=</code> by returning 404. </li>
<li>Generic login errors (prevents information leakage). </li>
<li>IP-based login rate limiting with transients (configurable threshold and window). </li>
<li>Restrict the REST API to authenticated users, with a minimal allowlist for oEmbed/index.</li>
</ul>
<blockquote>
⚠️ Important: The restrict REST API option and CSP can affect integrations and plugins. Test it in staging first.
</blockquote>
Privacy: the plugin does not send data to external services or create new tables. It only uses transients to count failed login attempts.

Security Hardener

Basic hardening: secure headers, enumeration blocking, generic login errors, IP-based rate limiting, and optional restriction of the REST API.

PF Secure Toolkit vs Security Hardener