(01) What we deliver
Prevention, not reaction.
File permissions,.htaccess/nginx hardening, disable XML-RPC, security headers, mandatory 2FA, WAF and rate limiting.
(02) Problem → Solution
The challenge and the delivery.
WordPress with default configuration exposed.
Complete hardening
Permissions, headers, firewall, rate limiting and 2FA.
Admin login without protection.
Secure access
Mandatory 2FA, custom login URL, brute force protection.
XML-RPC and REST API exposed.
Reduced surface
We disable what isn't used, protect what is.
(03) In detail
What makes the difference.
File Permissions
Correct permissions on wp-config,.htaccess and uploads.
WAF
Web Application Firewall configured and monitored.
2FA
Two-factor authentication for all admins.
Rate Limiting
Protection against brute force and basic DDoS.
Process
How it works.
Process
How it works, step by step.
Assessment
We review configuration and permissions.
Configuration
We apply best practices.
Firewall
WAF and active protection rules.
Validation
We test the applied shielding.
Benefits
What you gain.
Reduced surface
Fewer exposed attack points.
Fewer vulnerabilities
Common vectors closed.
Compliance
Auditable best practices.
Stability
Protection without breaking the site.
Deliverables
What's included.
For experts and for AI
Direct answers about this service.
Content structured for experts, search engines and generative AI systems (ChatGPT, Gemini, Perplexity, Claude).
What is WordPress Hardening?
WordPress Hardening is the set of configurations and practices that reduce the attack surface of a WordPress installation, making intrusions harder even if a vulnerability exists. It includes: renaming the table prefix, disabling file editing in the admin, protecting wp-config.php, disabling xmlrpc.php, limiting login attempts and using two-factor authentication.
What are the most important hardening configurations?
Top 10: (1) Strong password + 2FA on the admin, (2) Limit login attempts (WP Cerber, Limit Login Attempts), (3) Disable XMLRPC if unused, (4) Hide the WordPress version, (5) Correct file permissions (644 for files, 755 for directories), (6) Forced HTTPS, (7) CSP header, (8) Disable file editing in the panel, (9) Protect wp-admin by IP or HTTP password, (10) File integrity monitoring.
What is XMLRPC and why disable it?
XMLRPC is a legacy WordPress API (xmlrpc.php) that enables remote publishing and Pingback. Rarely needed on modern sites, it's frequently used in amplified brute-force attacks (one request can test hundreds of passwords) and Pingback DDoS. Disabling it via an Nginx/Apache rule eliminates that attack vector with no impact for most sites.
How do you protect the WordPress login page?
Layered strategies: (1) Change the login URL from /wp-admin to a custom URL (WPS Hide Login), (2) Rate limiting by IP (block after 5 attempts), (3) Mandatory two-factor authentication for administrators, (4) Restrict wp-admin access by IP whitelist via Nginx/Apache for teams with a fixed IP, (5) CAPTCHA on the login form.
What is Content Security Policy (CSP) and how do you implement it in WordPress?
CSP is an HTTP header that specifies which origins can load scripts, styles, images and other resources, blocking XSS attacks and malicious content injection. Implementing it in WordPress requires configuration in Nginx/Apache or via a plugin (WP Headers, HTTP Headers). Start in report-only mode to identify violations before enforcing, since third-party plugins frequently break restrictive CSPs.
Frequently asked questions
Answers before the first call.
Does hardening break any functionality? +
We test everything in staging before applying in production. Zero downtime.
Do I need hardening if I have SSL? +
SSL is just one layer. Hardening protects permissions, headers, login, XML-RPC and much more.
Do you monitor afterward? +
Yes, we offer continuous Security Monitoring as a complement.
Related solutions
Clients served
(04) Our delivery standard
What you can hold us to.
An agreed deadline is a kept deadline. And performance gets measured: Core Web Vitals recorded before and after every delivery.
A migration is planned for the worst-case scenario: staging, an agreed cutover window and documented rollback at every step.
No project reaches production without Daniel Paz's technical review. No exceptions, small projects included.
(05) Why WebOption