Most WordPress sites ship with a wide-open attack surface: XML-RPC exposed, the file editor enabled, usernames enumerable, and the version number broadcast in every response. Each item below closes one of those doors. You can do them by hand — or toggle them from Security → Hardening inside SwissSuite-AI, which also warns you before any change that could affect a plugin you rely on.
Essential Hardening Free
Available on every site, including the free tier.
Block Legacy Remote Access (XML-RPC)
Closes the XML-RPC back door — a favourite target for brute-force and pingback DDoS. Only keep it on if you rely on the WordPress mobile app or older Jetpack.
Disable the File Editor
Removes the in-dashboard theme/plugin code editor, so a stolen admin session can’t be used to inject PHP directly from the browser.
Prevent Malware Execution in Uploads
Blocks execution of .php files inside wp-content/uploads/ — the folder attackers most often drop shells into after a breach.
Hide WordPress Fingerprints
Strips the WordPress version from headers, RSS and HTML, and blocks readme.html and wp-config-sample.php so bots can’t fingerprint your exact version.
Hide Your Username List
Blocks the ?author=N enumeration trick that leaks your login usernames to anyone who asks.
Restrict AI Crawlers to Homepage
Adds robots rules keeping ChatGPT, Claude, Perplexity, Bing AI and others from crawling beyond your homepage.
Restrict Google to Homepage Only High impact
Disallows Googlebot and Bingbot everywhere except /. Powerful for a private/staging site — but it removes your inner pages from search, so it’s confirmation-gated.
Advanced Hardening Pro
Deeper controls for sites that can accommodate them. Each high-impact toggle checks your active plugins for conflicts first.
Add Browser Security Rules High impact
Sends X-Frame-Options, Content-Security-Policy, Strict-Transport-Security and related headers. May stop your site being embedded elsewhere, so it’s confirmation-gated.
Limit What Strangers Can See High impact
Blocks anonymous REST API access. Powerful, but can break checkout and contact forms — SwissSuite-AI warns you if WooCommerce or similar is active before enabling.
Hide Author Profile Pages
Disables author archive pages, which leak admin usernames. Not recommended for multi-author blogs.
Block Aggressive Web Crawlers
Blocks scraping bots (Ahrefs, Semrush, MJ12 and friends) at the firewall level. Never affects Google or Bing.
Disable Visitor-Triggered Scheduling High impact
Turns off WordPress’s cron-on-pageview behaviour and blocks public wp-cron.php. Set up a real server cron job first, or scheduled tasks stop firing — so it’s confirmation-gated.
Content Source Monitoring
A report-only Content Security Policy. It blocks nothing; it just collects violation reports so you can see what would be affected before enforcing.
Do All Thirteen in One Click Each
SwissSuite-AI enforces every control on this page from one dashboard — with a conflict check before anything risky, and an “Apply Recommended Level” button that picks a safe preset for your exact setup.