{"slug":"wordpress-security-hardening","title":"WordPress Security Hardening","tags":["security","wp-config","hardening"],"agent_summary":"wp-config.php and .htaccess hardening constants and rules to lock down a WordPress site.","trigger_phrases":["wordpress security","harden wordpress","wp-config security","disable file editing wordpress"],"runnable":false,"markdown":"\nApply these hardening constants to `wp-config.php` and rules to `.htaccess` on every production WordPress site.\n\n## wp-config.php Constants\n\n```php\n// Disable file editing from WordPress admin\ndefine('DISALLOW_FILE_EDIT', true);\n\n// Disable plugin/theme installation\ndefine('DISALLOW_FILE_MODS', true);\n\n// Force SSL for admin area\ndefine('FORCE_SSL_ADMIN', true);\n\n// Hide WordPress version\nremove_action('wp_head', 'wp_generator');\n\n// Limit post revisions\ndefine('WP_POST_REVISIONS', 5);\n\n// Increase memory limits\ndefine('WP_MEMORY_LIMIT', '256M');\ndefine('WP_MAX_MEMORY_LIMIT', '512M');\n```\n\n## Regenerate Security Keys\n\nGenerate fresh salts at `https://api.wordpress.org/secret-key/1.1/salt/` and paste into wp-config.php. Regenerate after any suspected compromise.\n\n## .htaccess Rules\n\n```apache\n# Protect wp-config.php\n<files wp-config.php>\norder allow,deny\ndeny from all\n</files>\n\n# Protect .htaccess\n<files .htaccess>\norder allow,deny\ndeny from all\n</files>\n\n# Disable directory browsing\nOptions -Indexes\n\n# Force HTTPS\nRewriteEngine On\nRewriteCond %{HTTPS} off\nRewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]\n```\n\n## Plugin Recommendations\n\n| Need | Plugin |\n|------|--------|\n| Firewall + brute force | Wordfence |\n| Login URL change | WPS Hide Login |\n| Full audit + WAF | Sucuri |\n| Integrity scanning | WP Cerber |\n\nRun Wordfence scan after applying hardening to confirm no residual issues.\n","html":"<p>Apply these hardening constants to <code>wp-config.php</code> and rules to <code>.htaccess</code> on every production WordPress site.</p>\n<h2>wp-config.php Constants</h2>\n<pre><code class=\"language-php\">// Disable file editing from WordPress admin\ndefine('DISALLOW_FILE_EDIT', true);\n\n// Disable plugin/theme installation\ndefine('DISALLOW_FILE_MODS', true);\n\n// Force SSL for admin area\ndefine('FORCE_SSL_ADMIN', true);\n\n// Hide WordPress version\nremove_action('wp_head', 'wp_generator');\n\n// Limit post revisions\ndefine('WP_POST_REVISIONS', 5);\n\n// Increase memory limits\ndefine('WP_MEMORY_LIMIT', '256M');\ndefine('WP_MAX_MEMORY_LIMIT', '512M');\n</code></pre>\n<h2>Regenerate Security Keys</h2>\n<p>Generate fresh salts at <code>https://api.wordpress.org/secret-key/1.1/salt/</code> and paste into wp-config.php. Regenerate after any suspected compromise.</p>\n<h2>.htaccess Rules</h2>\n<pre><code class=\"language-apache\"># Protect wp-config.php\n&#x3C;files wp-config.php>\norder allow,deny\ndeny from all\n&#x3C;/files>\n\n# Protect .htaccess\n&#x3C;files .htaccess>\norder allow,deny\ndeny from all\n&#x3C;/files>\n\n# Disable directory browsing\nOptions -Indexes\n\n# Force HTTPS\nRewriteEngine On\nRewriteCond %{HTTPS} off\nRewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]\n</code></pre>\n<h2>Plugin Recommendations</h2>\n<p>| Need | Plugin |\n|------|--------|\n| Firewall + brute force | Wordfence |\n| Login URL change | WPS Hide Login |\n| Full audit + WAF | Sucuri |\n| Integrity scanning | WP Cerber |</p>\n<p>Run Wordfence scan after applying hardening to confirm no residual issues.</p>\n"}