Most WordPress hardening advice is busywork. Here are the changes that actually shrink your attack surface and stop real attacks — plus the one layer a checklist structurally cannot give you.

A few built-in WordPress behaviours quietly widen your attack surface. Here are the ones worth disabling, all reversible and no code required.