WordPress Security
WordPress hardening
Extra protections that reduce your attack surface, under Settings → Advanced.
Beyond IP checks, Predax can close common WordPress weak spots. Open Settings → Advanced → WordPress Hardening ("Hardening Options — reduce your attack surface").
What each option does
- XML-RPC protection — limits or disables
xmlrpc.php, a frequent target for brute-force and pingback abuse. - Block user / author enumeration — stops
?author=Nprobes and the REST users endpoint from leaking your usernames to logged-out visitors. Recommended for everyone. - Hide WordPress version — removes the version number from your page source and RSS feeds, so attackers cannot easily target known version bugs.
- Auto-ban repeat firewall offenders — instead of filtering each bad request one at a time, temporarily ban an IP after it trips the firewall repeatedly. Set the firewall ban threshold (hits within 10 minutes).
Recommendation
Turning all of these on is safe for almost every site and meaningfully reduces automated attacks. If you use a service that relies on XML-RPC (some older apps do), choose the option that blocks amplification rather than disabling it completely.