WordPress ships with reasonable defaults but leaves a lot of optional security up to the site owner. Guardian Gaze's hardening menu exposes fifteen specific toggles (disable file editing, kill XML-RPC, hide the WP version, rotate secret keys, lock down wp-config.php, and more) each labelled with the actual trade-off so you can decide what fits your site.
Most successful WordPress compromises don't start with malware; they start with a configuration weakness that lets an attacker get in, after which malware is the payload. Hardening closes the doors and windows the attacker would have used. None of these settings are exotic; they're standard WordPress security recommendations made one-click-applyable, with the trade-off of each explained.
Removes the Theme and Plugin code editors from /wp-admin/. With this off, an attacker who steals an admin password can't immediately drop a backdoor through the UI.
XML-RPC is a legacy API used by attackers for brute-force amplification and DDoS reflection. Most modern sites don't need it. Toggle on; turn off only if you use the Jetpack/WP mobile apps.
Removes the WP version number from meta tags, RSS feeds and HTML comments. Doesn't make you safer per-se, but stops version-targeted attack scripts from confirming you're vulnerable.
The full version, scrubs version from script and stylesheet URLs too. Plugin and theme updates still work; only the version disclosure is suppressed.
Blocks direct HTTP access to wp-config.php, readme.html,license.txt, and other files that disclose your stack. Returns 403.
Disables WordPress's repair.php endpoint which can be abused if left active in production. You can re-enable it temporarily via wp-config.
Stops verbose MySQL errors from being shown to visitors. Errors still log to your server-side logs.
Rotates the WordPress secret keys and salts in wp-config.php. Invalidates all current sessions, anyone logged in (legitimate or not) is signed out. Useful after a known compromise.
Salts the WP auth cookie hash so it's unique to your site. Helps against cross-site session prediction attacks.
Blocks .php, .phtml,.exe, and other unsafe file types from being uploaded to the media library, even by admins.
Forces WP_DEBUG off in production. Debug-level errors disclose paths and stack traces useful to attackers.
If your site doesn't use comments, disable them sitewide. Closes a vector for SEO spam and stored XSS.
Blocks unauthorised modification of the siteurl andhome options. Attackers redirect these to malicious domains; this toggle freezes them.
Restrict the WordPress admin area to a specific set of trusted IP addresses. Combined with 2FA, this is the strongest configuration for login security.
Adds a hidden forbidden folder to robots.txt. Legitimate crawlers honour it; bots that ignore it and visit the folder get auto-blocked. Useful trap.
These seven are safe defaults for the vast majority of sites; they close real attack vectors without breaking common WordPress workflows. Turn them on first; revisit the rest if your threat model warrants.
The recommendations preset turns these seven on with a single click. You can always tweak individual toggles afterwards. Hardening changes are reversible, flip a toggle off and the setting returns to WordPress's default.
Hardening after a confirmed compromise is different from hardening for prevention. Apply these immediately after cleanup to invalidate the attacker's persistence and reduce the chance of re-infection.
| Capability | Free | Pro | Agency |
|---|---|---|---|
| All 15 hardening toggles | ✓ | ✓ | ✓ |
| Recommended-settings one-click apply | ✓ | ✓ | ✓ |
| Regression alerts (when a toggle gets disabled) | ✗ | ✓ | ✓ |
| Hardening status in Risk Score | ✓ | ✓ | ✓ |
| Multi-site sync of hardening profile | ✗ | ✗ | ✓ |
Install free, open the Hardening screen, click "Apply Recommendations". You'll have closed the seven most common WP attack vectors before you finish your coffee.