ylsine

Do you have a blog that really only want ready by humans? Do think that 
<a href="http://google.com/" rel="nofollow ugc">robots</a> should never be able to read your blog, even if they ignore your robots.txt? Is privacy your number one concern? Do your friends think of you as “that total privacy nut…you know too much so.”? Then this plugin is for you. The 404er will make every public page of your blog return a <a href="http://en.wikipedia.org/wiki/HTTP_404" rel="nofollow ugc">404</a> instead of the normal <a href="http://en.wikipedia.org/wiki/List_of_HTTP_status_codes#2xx_Success" rel="nofollow ugc">200</a>. Yes, you could use the normal <a href="https://codex.wordpress.org/Settings_Privacy_SubPanel" rel="nofollow ugc">privacy subpanel</a>, but that would be sooo pedestrian. Step up to the real (excessive, <a href="http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html#sec10.4.5" rel="nofollow ugc">RFC abbusing</a>) 404!
Note: If you did not detect any humor in the above text or you do not know what a 404 is, then, in all caps, DO NOT INSTALL THIS PLUGIN!

The 404er

This plugin will send a 404 header for every public page on your blog.

Marc Armengou

Security Hardener is inspired by the official WordPress hardening guide (Advanced Administration / Security / Hardening). It uses the platform’s standard functions and does not override core. Applies a prudent set of defenses:
<ul>
<li>Security headers: <code>X-Frame-Options</code>, <code>X-Content-Type-Options</code>, <code>Referrer-Policy</code>, <code>Permissions-Policy</code>, <code>COOP/CORP</code>. </li>
<li>HSTS (optional; HTTPS only). </li>
<li>Basic nonce-based CSP (optional; requires testing). </li>
<li>Disable XML-RPC and pingbacks (optional; enabled by default). </li>
<li>Hide the WordPress version in the <code><head></code>. </li>
<li>Block user enumeration via <code>/?author=</code> by returning 404. </li>
<li>Generic login errors (prevents information leakage). </li>
<li>IP-based login rate limiting with transients (configurable threshold and window). </li>
<li>Restrict the REST API to authenticated users, with a minimal allowlist for oEmbed/index.</li>
</ul>
<blockquote>
⚠️ Important: The restrict REST API option and CSP can affect integrations and plugins. Test it in staging first.
</blockquote>
Privacy: the plugin does not send data to external services or create new tables. It only uses transients to count failed login attempts.

Security Hardener

Basic hardening: secure headers, enumeration blocking, generic login errors, IP-based rate limiting, and optional restriction of the REST API.

The 404er vs Security Hardener