Skip to content
Merlin Tools

WordPress hardening snippets

Close the most-abused doors, with a tick.

Genuinely free. No sign-up, no email, no limits, no cookies. We don't store the URL you analyse.

Code
<?php

// Disable XML-RPC
add_filter( 'xmlrpc_enabled', '__return_false' );

// Block user enumeration via ?author=N
add_action( 'template_redirect', function () {
	if ( ! is_admin() && isset( $_GET['author'] ) ) {
		wp_redirect( home_url(), 301 );
		exit;
	}
} );

// Disable outgoing pingbacks
add_action( 'pre_ping', function ( &$links ) {
	$links = array();
} );

// Disable the file editor (setting it in wp-config.php is even better)
if ( ! defined( 'DISALLOW_FILE_EDIT' ) ) {
	define( 'DISALLOW_FILE_EDIT', true );
}

What it's for

Many WordPress attacks exploit features that are on by default and rarely used: XML-RPC, user enumeration, pingbacks. Tick what to close and get a single commented block for a functionality plugin. It generates code: it does not touch your site.

← All WordPress tools

Frequently asked questions

›Does this tool secure my site?

No: it generates code that you then install yourself. It doesn't connect to your site and checks nothing. For a scan of real issues use the WordPress vulnerability check.