POST/xmlrpc.php200 OK

Disable XML-RPC

One request can carry hundreds of password guesses, and login limits on the form never see them.

password guessingnginxApacheWordPress GET/wp-json/wp/v2/users200 OK

Stop user enumeration

Three URLs hand out every login name. Close all three without breaking author pages.

half of every loginWordPressnginxApache GET/wp-content/uploads/shell.php200 OK

Block PHP in uploads

The last step of most takeovers. Make an uploaded script inert, and test that it is.

takeovernginxApache POST/wp-login.php200 × 10,000

Limit login attempts

WordPress lets one address guess as fast as the server answers. What a limit can and cannot stop.

brute forcenginxplugins HEAD/0 of 5 headers

Security headers

Five response headers that make browsers refuse whole classes of attack, with values that are safe.

your visitorsnginxApacheWordPress GET/wp-admin/open to all

Restrict wp-admin by IP

The strongest single step for a site with a few editors, without breaking admin-ajax or locking yourself out.

admin accessnginxApache