<\/span><\/h2>\nHardening is the process of reducing your attack surface.<\/span> It’s about closing unnecessary doors and windows so attackers have fewer ways to try and get in.<\/p>\n<\/span>Technical Hardening Measures<\/span><\/h3>\nThese are small but powerful tweaks you can make. Many can be implemented via a good security plugin, but it’s essential to understand what they do.<\/p>\n
\n- Disable File Editing:<\/b> Add
define('DISALLOW_FILE_EDIT', true);<\/code> to your wp-config.php<\/code>. This removes the “Theme Editor” and “Plugin Editor” from the dashboard. If an attacker gets access to an admin account, this single line of code prevents them from easily injecting malicious PHP code into your theme and plugin files.<\/li>\n- Disable XML-RPC:<\/span><\/b> XML-RPC is an old protocol that allowed remote connections to your site (for things like the original mobile app).<\/span> Today, it’s largely obsolete for most users and is a massive target for brute-force login attacks and DDoS attacks. An attacker can use its
system.multicall<\/code> function to try thousands of passwords in a single HTTP request, bypassing many standard login-limiting tools. Unless you have a specific, modern tool that requires it, disable it. You can do this with a helper plugin or by adding a filter to your theme’s functions.php<\/code> or a custom plugin.<\/li>\n- Implement Security Headers:<\/span><\/b> HTTP Security Headers are instructions your server sends to the user’s browser, telling it how to behave.<\/span> They can prevent attacks like cross-site scripting (XSS) and clickjacking. Key headers include
Content-Security-Policy<\/code> (CSP), X-Frame-Options<\/code>, and Strict-Transport-Security<\/code> (HSTS). While configuring a full CSP can be complex, even setting basic headers provides a significant security boost.<\/li>\n- Correct File Permissions:<\/b> Incorrect file permissions are a common mistake. Your server files shouldn’t be wide open for anyone to write to. The standard, secure permissions are:\n
\n- Folders:<\/b>
755<\/code><\/li>\n- Files:<\/b>
644<\/code><\/li>\nwp-config.php<\/code>:<\/b> 440<\/code> or 400<\/code><\/li>\n- This ensures that only the owner (you) can write to files, while others can only read and execute them.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
<\/span>Apply Network-Wide Security Safeguards: Your Elite Guard<\/span><\/h2>\nIndividual hardening tweaks are great, but for a network, you need broad, overarching protection. These network-wide tools are essential for maintaining airtight WordPress multisite security.<\/p>\n
<\/span>The Web Application Firewall (WAF) is Your Bouncer<\/span><\/h3>\nA WAF is one of the most effective security tools you can deploy.<\/span> It sits between your website and the internet, inspecting all incoming traffic. Think of it as the bouncer at a nightclub. It checks every visitor’s ID and turns away anyone who looks suspicious or is on a known troublemaker list before<\/i> they even get to the door.<\/p>\nA good WAF will block:<\/p>\n
![\"The](\"https:\/\/zalvis.com\/blog\/wp-content\/uploads\/2025\/07\/Zalvis-Blog-6.png\")
<\/p>\n