Make two-factor mandatory for all WordPress users (emailed-code floor, per-role exclusions) and lock the XML-RPC/REST API-login path to an allowlist. Optional must-use mode.
Modular WordPress admin performance booster. 18 toggle-able modules: heartbeat throttle, dashboard widget cleanup, disable comments, REST lockdown, emoji/oEmbed disable, jQuery Migrate kill, classic editor, XML-RPC disable, hide login URL, custom login page,…
Security-Hardening für WordPress: User-Enumeration blocken, Feeds aus, Security-Header, WP-Schmodder und XML-RPC raus.
CoreSlim: zero-bloat WordPress core optimizer & speed switch. Disable emojis, XML-RPC, embeds, version disclosure, Heartbeat, revisions and autosave overhead with zero bloat. Free, GPL-2.0-or-later.
WordPress Security Plugin - Protects against XSS, file injection, brute force, XML-RPC attacks, and more. By Sravan M
Blocks common WordPress paths for user enumeration, secures the REST API, disables user sitemaps, and protects against XML-RPC attacks.