📊 Protection Overview
Quick view of each hardening protection status. Green cards indicate active protections; red ones need attention.
🔐 Admin Panel Security
Protect access to the WordPress admin panel by changing the login URL and hiding wp-admin from attackers.
🔑 Hide Login URL (wp-admin)
Change the default login URL (/wp-admin, /wp-login.php) to a custom URL only you know. Any access attempt to the original URL returns a 404 error, hiding the existence of wp-admin.
Custom Slug
Choose any slug (e.g., my-login, admin-access, secure-backend). Your new login URL will be https://yoursite.com/my-login/.
🔁 Automatic Redirect
When an authenticated user visits /wp-admin/, they are automatically redirected to your custom slug without interruption.
🚨 Emergency Restore URL
If you get locked out of the admin, you can use an emergency URL to instantly disable both "Hide wp-admin" and "Hide wp-login.php" and return to the normal login. It's not a generic or guessable URL: it carries a unique, random 64-character key generated just for your site, in this format:
Copy your real URL (with your real key already included) from the "Admin Area Hiding" card on the Hardening page itself, before enabling either protection, and save it somewhere safe. If you ever suspect that URL has leaked, you can regenerate the key with the "Regenerate" button on that same card — the old URL stops working instantly.
🌐 APIs & Services
Control access to WordPress web services: XML-RPC and REST API. Disabling or restricting these services reduces the attack surface.
📡 XML-RPC
Disabling XML-RPC blocks mobile apps, Jetpack, WooCommerce, and other services that rely on this protocol. Evaluate if your site needs it before disabling.
🔗 REST API
Restrict REST API access to authenticated users only. Public endpoints become inaccessible to anonymous visitors, protecting user data, posts, and settings.
⚠️ Impact of Disabling XML-RPC
- Mobile apps: The official WordPress app will not be able to connect to your site.
- Jetpack: Many Jetpack features stop working.
- WooCommerce: Some payment gateways and shipping extensions use XML-RPC.
- Pingbacks/Trackbacks: Completely disabled, which is positive for avoiding DDOS attacks.
📁 Files & Directories
Protect your WordPress installation files and directories against unauthorized access, malicious code execution, and sensitive information exposure.
🚫 Directory Listing
Disables server directory listing via the Options -Indexes directive in .htaccess. Prevents visitors from seeing the contents of directories without an index.php.
🔒 Sensitive Files
Blocks direct access to critical files such as wp-config.php, .htaccess, error_log, and other system configuration files.
🚫 PHP in Uploads
Blocks PHP file execution (.php, .phtml, .php5) inside the wp-content/uploads/ directory. Prevents attackers from executing malicious shells uploaded as images.
📄 Hidden Files
Hides installation and information files such as readme.html, changelog.txt, license.txt, and wp-config-sample.php. These files reveal the WordPress version and system details.
🌐 Folders Outside WordPress
Any folder living in your hosting root outside WordPress is served directly by the server, never going through WordPress or the firewall — the firewall never gets to see it. This protection covers those folders with the same defenses as the rest of your site: IP blocking, rate limiting, geo-blocking, and DDoS mode.
wp-admin, wp-content, and wp-includes) to protect. It isn't a good fit for high-traffic folders: every visit goes through an extra security check before the content is served, just like the rest of your site, which adds a small extra load on the server. SeenSecure applies and reverts this protection automatically: disabling it, deactivating the plugin, or uninstalling it restores everything to its original state without any action on your part.
🗄️ Database Security
Protect your database against user enumeration and other attack vectors that expose sensitive information about registered users.
🚫 Disable User Enumeration
WordPress exposes usernames through URLs like /?author=N. An attacker can change the number N (1, 2, 3...) to discover all registered usernames and then use that information for brute-force attacks.
🔍 How the attack works
The attacker obtains usernames and uses them for password attacks.
🛡️ How SeenSecure blocks it
Returns a 404 error when an enumeration attempt via ?author=N or ?author_name= is detected. It also blocks the REST API endpoint that exposes usernames.
📡 Protect Author in Feeds (RSS/RDF/Atom)
What it's for: besides ?author=N URLs, there's another username-leak path many sites overlook: the RSS, RDF, and Atom feeds WordPress generates automatically. Every feed entry shows the author's public name — and if that public name is identical to the username used to log into the panel, anyone reading the feed gets the real username without scanning anything.
Why this makes brute force easier: a brute-force attack needs two things — a valid username and passwords to try against it. Without the username, the attacker would also have to guess that, multiplying the effort required. Once they get the real username from the feed, they only have one problem left to solve (the password) instead of two, and can launch the attack directly against that specific account.
🔍 When there's risk
Only when an account's «display name publicly as» (Users > Your Profile) is identical to its login username. Many sites leave it this way without realizing it, because that's the default value WordPress fills in when the account is created.
🛡️ How SeenSecure protects it
Checks, only inside feeds, whether the name about to be shown matches that account's real username. If it matches, it shows the site name instead. If they're already different, it doesn't touch anything — the rest of the site keeps showing the author name normally.
How to enable it: SeenSecure > Protections > Database > Protect Author in Feeds (RSS/RDF/Atom). Enabled by default, alongside the ?author=N protection described above. It's an independent switch — you can have one enabled and not the other, though it's recommended to keep both on.
⚙️ Panel & File Settings
Configure additional hardening options to close common attack vectors related to information exposure and unauthorized editing.
🔍 Hide WordPress Version
Removes the <meta name="generator" content="WordPress X.X" /> tag from HTML and RSS feeds. Attackers use the version to look up specific known vulnerabilities.
✏️ Disable File Editor
Disables the theme and plugin editor from the admin panel. Sets the DISALLOW_FILE_EDIT constant to true in wp-config.php. Prevents attackers with admin access from directly modifying PHP files.
🚫 Plugin/Theme Installation
Disables plugin and theme installation, update, and deletion from the admin panel. Useful on managed sites where changes go through a controlled process.
🔗 Remove Generator Meta Tags
Removes the <meta name="generator"> tag that WordPress automatically inserts in <head> and in RSS feeds with the exact version number.
🔌 API Security
Protects XML-RPC and REST API against DDoS amplification attacks, brute force, and user enumeration.
🔒 Restrict REST API
Restricts WordPress REST API access to authenticated users only and controls which endpoints are allowed to prevent reconnaissance.
👤 Disable REST API Users
Blocks the /wp/v2/users endpoint for unauthenticated users, closing a reconnaissance route attackers use to enumerate valid usernames before targeted attacks.
💬 Comments Security
Protect the WordPress comments system against automated spam and injection attacks with intelligent CAPTCHA and activity monitoring.
🧩 CAPTCHA for Comments
Adds a CAPTCHA challenge to the comment form to verify the visitor is human. Available in three modes:
👁️ Visual CAPTCHA
Displays 4 images (for example, a car, a tree, a house, and a flower) and the user must select the correct one. Does not require typing distorted text.
🔢 Math CAPTCHA
Presents a simple math operation (e.g., 7 + 3 = ?). Easy for humans, hard for bots. No image support required.
😀 Emoji CAPTCHA
Asks the user to select the correct emoji from a set. Modern and fun visual experience for visitors.
📊 Stats Dashboard
The system displays real-time statistics on CAPTCHA performance and blocked spam attempts:
🚫 Blocked Today
47
Spam attempts blocked in the last 24 hours
✅ Success Rate
98.7%
Percentage of legitimate comments that pass the CAPTCHA
📦 Total Blocked
12,843
Total spam attempts blocked since activation
Frequently Asked Questions
I got locked out of the panel after hiding wp-admin, what do I do? Use your Emergency Restore URL (the one you copied with your unique key from the Admin Area Hiding card) — it instantly disables the hiding so you can log back in. Save it somewhere safe before enabling the protection, not after: without it there's no other way to recover access short of direct server access.
A plugin stopped uploading images after I enabled "No PHP execution in uploads" That protection prevents PHP files from being EXECUTED inside the uploads folder, not normal files (images, PDFs, etc.) from being uploaded — if a legitimate plugin stops uploading something, check whether it's trying to upload an executable format rather than a normal content file.
Can I enable only some of the protections on this page, not all of them? Yes, each card in the Protections Summary is enabled/disabled independently; you don't need to turn them all on at once.
I disabled XML-RPC and now Jetpack or my WordPress mobile app is broken That's expected: XML-RPC is the protocol used by the official WordPress app, much of Jetpack, and some WooCommerce payment/shipping gateways. If you need any of those tools, turn it back on.