WordPress hardening best practices

When to use this skill

Use this skill for site/environment configuration, as opposed to plugin code:

• Editing wp-config.php (keys, constants, debug).
• Writing/reviewing .htaccess (Apache) or server-block (nginx) rules.
• Setting filesystem permissions and ownership.
• Locking down wp-admin, XML-RPC, REST user enumeration, and the uploads dir.
• Pre-launch hardening checklists and deployment review.

This complements the secure-coding skills: even perfect code runs on a host that must be configured to fail safely.

Core principles (and why they matter)