Enable HTTP Strict Transport Security (HSTS)
Tells browsers to always use HTTPS for your domain for one year. Only enable it once the whole site, including subdomains you use, works over HTTPS.
Snippet Library
Security snippets for WordPress
Snippets that harden WordPress: turn off XML-RPC, hide the version number, stop user enumeration, add security headers and block risky uploads. Small, reviewable changes for site owners who want fewer attack points without a heavy security plugin.
Site Health Check for Security Headers
Adds a Site Health test that loads your homepage and reports which common security headers (HSTS, CSP, nosniff, framing, referrer and permissions policies) are missing.