"Security Hardening" Doesn't Mean Anything Until Someone Tells You What's In It
I get asked some version of this a few times a month: "what does security hardening actually mean?" Usually from someone comparing a couple of managed hosting quotes that both list "security hardening" as a bullet point, with nothing behind it. Fair question — it's one of those phrases that's used constantly and defined almost never.
Hardening isn't a single feature. It's a batch of small configuration changes, and each one shuts off one specific way attackers commonly poke at a WordPress site. Individually, none of them sound like much. Together, they're most of what separates a site that gets left alone from one that gets hit the week a new plugin vulnerability makes the rounds.
What's Actually In It
This is the list we apply to every site we manage. Not a marketing version of it — the actual settings:
- Hide the WordPress version. Attackers scan for known vulnerabilities by version number — if they can't see it, they can't target it.
- Block username enumeration. WordPress will hand out valid usernames through author pages and the REST API if you let it. We shut that door.
- Mask login error messages. A failed login shows the same generic message every time, so nobody can tell if they guessed a real username.
- Disable the file editor. WordPress lets admins edit theme and plugin code right from the dashboard. If that account is ever compromised, we don't want that door open too.
- Add security headers. A few extra HTTP headers tell browsers to block clickjacking and content-sniffing attacks before they start.
- Rate-limit login attempts. Too many failed logins from one source and it gets throttled — brute-force attacks stop being worth the time.
- Block known attacker IPs. If an IP has already been caught attacking other sites, it doesn't get a chance at yours.
- Disable XML-RPC when it's safe to. This old WordPress feature is a favorite for brute-force and DDoS abuse. We turn it off — unless a site actually needs it for Jetpack or the mobile app.
- Require strong passwords. Every account has to meet a minimum strength standard, so a weak password doesn't undo everything else.
- Require two-factor authentication for admins. A password alone isn't enough — every admin needs a second step to log in.
What This Doesn't Do
I want to be straight about this, because it's easy to oversell: none of the above fixes a real vulnerability. If a plugin on your site has an actual security hole, hardening doesn't patch it — an update does. What hardening buys you is a smaller, less obvious target in the meantime, and one less way in if that vulnerability sits unpatched for a few days before you or your host catch it. Hardening and staying current on updates are two different jobs. You need both. Neither one covers for the other.
Why Nobody Explains This
Because it's boring to explain and there's nothing to show for it. None of these settings produce a dashboard graph or a screenshot worth putting in a sales deck — they're just configuration flags that either exist or don't. So "security hardening" becomes shorthand, and most buyers never push past the phrase to ask what's actually turned on. The honest answer is that you mostly notice this stuff working by what doesn't happen — no defaced homepage, no "your site has been compromised" email at 2am, nothing to point at.
How We Handle It
This is the baseline on every site we manage through our managed WordPress plan — not an add-on, not something you have to ask for. Version hiding, enumeration blocking, masked login errors, the file editor turned off, security headers, rate-limited logins, known-attacker IPs blocked, XML-RPC off unless a site actually needs it, strong passwords enforced, and two-factor required for every admin. If your site is the kind where downtime or a breach is a real problem — not just an inconvenience — the Managed Stability plan layers ongoing monitoring on top of all of this.
If you're comparing this against your current hosting, two related questions are worth asking: does your current host's "security" actually cover any of this, and if you're running a security plugin already, whether it's covering the same ground as hardening, or something different entirely.
