Content Security Policy Header (Report-Only)
Sends a starter Content Security Policy in report-only mode, so you can see in the browser console what a strict policy would block before enforcing it.
Snippet Library
Security snippets for WordPress
Snippets that harden WordPress: turn off XML-RPC, hide the version number, stop user enumeration, add security headers and block risky uploads. Small, reviewable changes for site owners who want fewer attack points without a heavy security plugin.