manifest / security / wp-security-plugin

Core Security Hardening

Disables various seldom used features of WordPress to improve security. Works for standard and bedrock WordPress installs. Each feature can be toggled under Settings > General > Hardening, or locked from config with a CORE_SECURITY_HARDENING_<FEATURE> constant.

by Karl Mantle · github.com/karl-mantle/wp-security-plugin

★ 0stars

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/karl-mantle/wp-security-plugin/archive/refs/heads/main.zip

No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

Readme github.com/karl-mantle/wp-security-plugin ↗

A must-use WordPress plugin that turns off features most sites don't use. Works on standard WordPress and Bedrock.

What it does

Each feature can be turned off under Settings -> General -> Hardening.

Feature	Constant	Default
Disable XML-RPC	`CORE_SECURITY_HARDENING_XMLRPC`	On
Block username enumeration	`CORE_SECURITY_HARDENING_AUTHOR_ENUMERATION`	On
Require login for the REST API	`CORE_SECURITY_HARDENING_REST_AUTH`	On
Disable comments	`CORE_SECURITY_HARDENING_COMMENTS`	On
Hide WordPress version	`CORE_SECURITY_HARDENING_GENERATOR`	On
Generic login errors	`CORE_SECURITY_HARDENING_LOGIN_ERRORS`	On
Send security headers	`CORE_SECURITY_HARDENING_SECURITY_HEADERS`	On
Disable the file editor	`CORE_SECURITY_HARDENING_FILE_EDIT`	On
Clean up the page head	`CORE_SECURITY_HARDENING_HEAD_CLEANUP`	On
Disable application passwords	`CORE_SECURITY_HARDENING_APPLICATION_PASSWORDS`	Off

Installation

Standard WordPress

Copy this folder into wp-content/mu-plugins/core-security-hardening/. WordPress doesn't load must-use plugins from subfolders on its own, so also create wp-content/mu-plugins/core-security-hardening.php containing:

<?php
require_once __DIR__ . '/core-security-hardening/core-security-hardening.php';

Or install it as a regular plugin: copy the folder into wp-content/plugins/ and activate it. It can then be deactivated from the admin.

Bedrock

composer require karlmantle/core-security-hardening

It installs into web/app/mu-plugins/, where Bedrock's autoloader picks it up.

Configuration

Overrides the setting in the admin, and the checkbox shows as locked.

// wp-config.php
define('CORE_SECURITY_HARDENING_REST_AUTH', false);

// Bedrock: config/application.php
Config::define('CORE_SECURITY_HARDENING_REST_AUTH', false);

With the REST API locked down, some plugins (contact forms 7, WooCommerce blocks) need public routes. Allow them with a filter:

add_filter('core_security_hardening_rest_public_routes', function ($routes) {
    $routes[] = '/contact-form-7/v1';
    return $routes;
});

Licence

MIT. See LICENSE.