Marc Armengou

Security Hardener is inspired by the official WordPress hardening guide (Advanced Administration / Security / Hardening). It uses the platform’s standard functions and does not override core. Applies a prudent set of defenses:
<ul>
<li>Security headers: <code>X-Frame-Options</code>, <code>X-Content-Type-Options</code>, <code>Referrer-Policy</code>, <code>Permissions-Policy</code>, <code>COOP/CORP</code>. </li>
<li>HSTS (optional; HTTPS only). </li>
<li>Basic nonce-based CSP (optional; requires testing). </li>
<li>Disable XML-RPC and pingbacks (optional; enabled by default). </li>
<li>Hide the WordPress version in the <code><head></code>. </li>
<li>Block user enumeration via <code>/?author=</code> by returning 404. </li>
<li>Generic login errors (prevents information leakage). </li>
<li>IP-based login rate limiting with transients (configurable threshold and window). </li>
<li>Restrict the REST API to authenticated users, with a minimal allowlist for oEmbed/index.</li>
</ul>
<blockquote>
⚠️ Important: The restrict REST API option and CSP can affect integrations and plugins. Test it in staging first.
</blockquote>
Privacy: the plugin does not send data to external services or create new tables. It only uses transients to count failed login attempts.

Security Hardener

Basic hardening: secure headers, enumeration blocking, generic login errors, IP-based rate limiting, and optional restriction of the REST API.

Poet Farmer

PF Secure Toolkit helps you secure your site by turning off WordPress components you may not need or want exposed.
Features include: 
* Disable Author Archives (301 redirect + remove users sitemap). 
* Disable Comments site-wide (removes UI, blocks REST, hides existing). 
* Disable WP Emojis (scripts, styles, TinyMCE, email/RSS, CDN prefetch). 
* Disable XML-RPC (removes headers, blocks pingback methods). 
* Quick toggle settings in the admin panel.

PF Secure Toolkit

PF Secure Toolkit is a lightweight, modular plugin to harden WordPress by disabling unnecessary features.

Security Hardener vs PF Secure Toolkit