I am convinced that for most WordPress users one of the popular all-in-one security plugins like WordFence or All In One WP Security & Firewall is a good solution. I like to tinker though, and to choose the best tool for me for each aspect of security. I also like light solutions, and a layered approach to security.
This is my full list of WP security settings and other security things:
- Free Plugins:
- Akismet (only on sites that allow comments)
- Disable WP Rest API
- Edit Author Slug
- Health Check & Troubleshooting
- Limit Login Attempts Reloaded
- Salt Shaker
- UpdraftPlus
- WPS Hide Login
- In my Custom Plugin
- Auto-update WP, themes, and plugins
- Remove Windows Live Writer link from header data
- Remove EditURI (XML-RPC) link from header data
- Disable password reset
- Disable login using email account name
- Disable login hints
- Disable login Remember Me option
- In main htaccess
- Set ErrorDocument for 400, 401, 403, and 500 to short text strings (e.g. “400: Sorry, bad request.”)
- The excellent 6G Firewall from Jeff Starr of Perishable Press
- Add security headers to protect against XSS attacks, page-framing, click-jacking, and content-sniffing
- Block directory browsing
- Block access to wp-config.php, xmlrpc.php, .htaccess, readme.html, license.txt, install.php, installer.php
- In other htaccess
- Block php execution in /wp-content/uploads/ – and – /wp-includes/ folders
- In wp-config.php:
- Disable the Plugin and Theme Editor
- Disable PHP error reporting
- Disable custom HTML
- In Cloudflare:
- Hide IP address for A and CNAME records
- Enable DNSSEC for my most most important sites
- Full (strict) SSL
- Always use HTTPS
- Enable HSTS for my most important sites
- Enable the latest version of the TLS protocol
- Security Level: Medium
- Challenge Passage: 4 hours
- Page rules for login security
- Email address obfuscation
- Hotlink protection
- Miscellaneous
- Non-obvious admin username (e.g. not ‘admin’)
- Strong passwords for my admin account, cPanel, host, registrar, email, Cloudflare – any account associated with administering my site
- Two factor authentication (used selectively – on accounts that matter most)
- TLS (i.e. HTTPS) using Let’s Encrypt
