WP Hardening (discontinued)

Disable Information Disclosure & Remove Meta information

1. 15Hide WordPress version number This gives away your WordPress version number making life of a hacker simple as they’ll be able to find targeted exploits for your WordPress version. It’s best to keep this hidden, enabling the button shall do that.
2. 16Remove WordPress Meta Generator Tag The WordPress Meta tag contains your WordPress version number which is best kept hidden
3. 17Remove WPML (WordPress Multilingual Plugin) Meta Generator Tag This discloses the WordPress version number which is best kept hidden.
4. 18Remove Slider Revolution Meta Generator Tag Slider revolution stays on the radar of hackers due to its popularity. An overnight hack in the version you’re using could lead your website vulnerable too. Make it difficult for hackers to exploit the vulnerabilities by disabling version number disclosure here
5. 19Remove WPBakery Page Builder Meta Generator Tag Common page builders often are diagnosed with a vulnerability putting your website’s security at risk. With this toggle enabled, the version of these page builders will be hidden making it difficult for hackers to find if you’re using a vulnerable version.
6. 20Remove Version from Stylesheet Many CSS files have the WordPress version number appended to their source, for cache purposes. Knowing the version number allows hackers to exploit known vulnerabilities.
7. 21Remove Version from Script Many JS files have the WordPress version number appended to their source, for cache purposes. Knowing the version number allows hackers to exploit known vulnerabilities.

Basic Server Hardening

1. 22Hide Directory Listing of WP includes WP-includes directory gives away a lot of information about your WordPress to hackers. Disable it by simply toggling the option to ensure you make reconnaissance of hackers difficult

Security Headers

1. 23Clickjacking Protection Protect your WordPress Website from clickjacking with the X-Frame-Options response header. Clickjacking is an attack that tricks a user into clicking a webpage element which is invisible or disguised as another element.
2. 24XSS Protection Add the HTTP X-XSS-Protection response header so that browsers such as Chrome, Safari, Microsoft Edge stops pages from loading when they detect reflected cross-site scripting (XSS) attacks.
3. 25Content Sniffing protection Add the X-Content-Type-Options response header to protect against MIME sniffing vulnerabilities. Such vulnerabilities can occur when a website allows users to upload content to a website, however the user disguises a particular file type as something else. This can give them the opportunity to perform cross-site scripting and compromise the website.
4. 26HTTP only & Secure flag Enable the HttpOnly and secure flags to make the cookies more secure. This instructs the browser to trust the cookie only by the server, which adds a layer of protection against XSS attacks.