WP Core Secure

🛡️ WP Core Secure Harden your WordPress site in minutes — no code, no config files, no cloud. Why WP Core Secure? A default WordPress installation ships with a handful of settings that create unnecessary attack surface — XML-RPC open to the internet, no limit on login attempts, usernames exposed through the REST API, no HTTP security headers, PHP executable inside the uploads folder. Most site owners never change these because fixing them properly means editing wp-config.php, writing .htaccess rules, and knowing exactly which WordPress filters to hook. WP Core Secure does all of that for you through a single settings page. Toggle what you need, click Save — the plugin writes the correct .htaccess rules, hooks the right filters, and sends the right HTTP headers. Deactivate the plugin and everything is cleaned up automatically. No leftover rules, no orphaned database rows. 22 security controls. 5 groups. One page. Zero telemetry. ✨ Features 🔧 Core Hardening | Control | What It Does | |---|---| | Disable XML-RPC | Blocks xmlrpc.php via WordPress filter and .htaccess. Stops brute-force amplification and DDoS pingback attacks. Removes RSD and WLW link tags from . | | Hide WordP