WordPress ships with a few behaviours, switched on by default, that quietly widen your attack surface. Most sites never use them, yet they hand attackers reconnaissance and extra ways in. The good news: every one of these is reversible and takes a single toggle — no code, no edited core files.
Disable the built-in file editor
Appearance → Theme File Editor lets anyone with admin access edit PHP straight from the dashboard. If an attacker steals an admin session, it becomes an instant code-execution tool. Almost nobody needs it; turn it off.
Turn off XML-RPC
XML-RPC is a legacy API used for brute-force amplification and pingback abuse. Unless you rely on it for a specific app, disabling it removes a favourite attacker endpoint.
Block user enumeration
By default, WordPress happily reveals your usernames through author archives and the REST API. That’s the first half of a login attack handed over for free. Block enumeration so attackers have to guess the username too.
Hide the WordPress version
Your exact version number sits in the page source and readme.html. It tells a scanner precisely which exploits to try. Removing it won’t stop a determined attacker, but it cuts out the easy automated targeting.
Disable pingbacks
Pingbacks can be abused to turn your site into part of a DDoS against someone else. If you don’t use them, switch them off.
Individually these are small. Together they remove a surprising amount of the automated noise that makes up the bulk of real-world WordPress attacks. DefendMyWP bundles all five as one-click hardening — reversible, with nothing written to your files.
