⛔ Auto-block for user enumeration (off by default)
Requests trying to list users (?author=N, /wp-json/wp/v2/users) are blocked in that request. Adding the IP to the permanent blocklist is a separate option, off by default: it is reconnaissance, not a confirmed attack, and a legitimate crawler can also do it.
Verified crawlers (Google, Bing) and official infrastructure are never blocked.
📊 Protection Overview
Quick view of each hardening protection status. Green cards indicate active protections; red ones need attention.
🔐 Admin Panel Security
Protect access to the WordPress admin panel by changing the login URL and hiding wp-admin from attackers.
🔑 Hide Login URL (wp-admin)
Change the default login URL (/wp-admin, /wp-login.php) to a custom URL only you know. Any access attempt to the original URL returns a 404 error, hiding the existence of wp-admin.
Custom Slug
Choose any slug (e.g., my-login, admin-access, secure-backend). Your new login URL will be https://yoursite.com/my-login/.
🔁 Automatic Redirect
When an authenticated user visits /wp-admin/, they are automatically redirected to your custom slug without interruption.
🚨 Emergency Restore URL
If you get locked out of the admin, you can use an emergency URL to instantly disable both "Hide wp-admin" and "Hide wp-login.php" and return to the normal login. It's not a generic or guessable URL: it carries a unique, random 64-character key generated just for your site, in this format:
Copy your real URL (with your real key already included) from the "Admin Area Hiding" card on the Hardening page itself, before enabling either protection, and save it somewhere safe. If you ever suspect that URL has leaked, you can regenerate the key with the "Regenerate" button on that same card — the old URL stops working instantly.
🌐 APIs & Services
Control access to WordPress web services: XML-RPC and REST API. Disabling or restricting these services reduces the attack surface.
📡 XML-RPC
Disabling XML-RPC blocks mobile apps, Jetpack, WooCommerce, and other services that rely on this protocol. Evaluate if your site needs it before disabling.
🔗 REST API
Restrict REST API access to authenticated users only. Public endpoints become inaccessible to anonymous visitors, protecting user data, posts, and settings.
⚠️ Impact of Disabling XML-RPC
- Mobile apps: The official WordPress app will not be able to connect to your site.
- Jetpack: Many Jetpack features stop working.
- WooCommerce: Some payment gateways and shipping extensions use XML-RPC.
- Pingbacks/Trackbacks: Completely disabled, which is positive for avoiding DDOS attacks.
🔕 Disable Pingbacks and Trackbacks
Pingbacks and trackbacks are automatic notifications between blogs. Today they are used almost only for spam and to abuse your server: an attacker can ask thousands of WordPress sites to "check a link" on the victim's site and take it down together (reflection DDoS), and the same request reveals your server's real IP even if it is behind a CDN.
- Incoming: pingbacks are rejected (the
pingback.pingmethod is removed from XML-RPC) and so are trackbacks (wp-trackback.phpreturns 403). - Outgoing: your site stops sending pingbacks and trackbacks to the sites you link to.
- Traces: the
X-Pingbackheader and the pingback link in the HTML are removed, and they are closed on every post (new ones included).
It does not affect normal comments or the rest of XML-RPC (mobile apps, Jetpack); it is independent of "Disable XML-RPC". Enable it in Hardening → APIs and Services.
📁 Files & Directories
Protect your WordPress installation files and directories against unauthorized access, malicious code execution, and sensitive information exposure.
🚫 Directory Listing
Disables server directory listing via the Options -Indexes directive in .htaccess. Prevents visitors from seeing the contents of directories without an index.php.
🔒 Sensitive Files
Blocks direct access to critical files such as wp-config.php, .htaccess, error_log, and other system configuration files.
🚫 PHP in Uploads
Blocks PHP file execution (.php, .phtml, .php5) inside the wp-content/uploads/ directory. Prevents attackers from executing malicious shells uploaded as images.
📄 Hidden Files
Hides installation and information files such as readme.html, changelog.txt, license.txt, and wp-config-sample.php. These files reveal the WordPress version and system details.
🌐 Folders Outside WordPress
Any folder living in your hosting root outside WordPress is served directly by the server, never going through WordPress or the firewall — the firewall never gets to see it. This protection covers those folders with the same defenses as the rest of your site: IP blocking, rate limiting, geo-blocking, and DDoS mode.
🧱 Block PHP in wp-includes
PHP files in wp-includes and wp-admin/includes are internal pieces that WordPress loads on its own: nobody needs to open them from the browser. This protection adds the rules from the official "Hardening WordPress" guide to .htaccess so the server returns 403 if someone requests them by URL.
- What it prevents: backdoors disguised among core files (such as
wp-includes/wp-vcd.php, from the WP-VCD malware) and errors that reveal the server's real path. - Real check: when you save, SeenSecure requests
wp-includes/version.phpand confirms the server returns 403. If the rules disappear from.htaccess, they are added back automatically. - Requirements: Apache or LiteSpeed (on Nginx, ask your hosting) and a non-multisite installation.
It does not affect styles, scripts or images in wp-includes. When disabled, the rules are removed from .htaccess. Enable it in Hardening → Files and Directories.
🧬 WordPress Core Verification
WordPress.org publishes the fingerprint (MD5 checksum) of every file of every version. SeenSecure compares the files in wp-admin, wp-includes and the root of your installation against it, for your version and language. If an attacker injects code into a core file (for example into wp-login.php to steal passwords), the file keeps working but its fingerprint no longer matches.
- When: automatically once a day, when you enable it and whenever you click "Check now".
- Result: the list of modified and missing files. Files that are normally deleted (
readme.html,license.txt,wp-config-sample.php) do not count. - Email alert: optional, to the address you choose (or the administrator's), once per different result so the same alert is not repeated every day.
- What it does not check:
wp-content(themes, plugins and uploads), because every site changes it.
Restore the originals with one click: if a file shows up and you did not edit it, click "Restore from WordPress.org". SeenSecure downloads each file from the official repository for your version, checks that it is identical to the published one and only then replaces it, first saving a copy of the current one in wp-content/ssc-core-backups/ (as .bak, with no web access). With SeenSecure PRO and file integrity monitoring (FIM) active you can also "Restore from the FIM copy", without depending on the internet. You can also reinstall WordPress from Dashboard → Updates → "Re-install version". Enable it in Hardening → Files and Directories.
wp-admin, wp-content, and wp-includes) to protect. It isn't a good fit for high-traffic folders: every visit goes through an extra security check before the content is served, just like the rest of your site, which adds a small extra load on the server. SeenSecure applies and reverts this protection automatically: disabling it, deactivating the plugin, or uninstalling it restores everything to its original state without any action on your part.
🗄️ Database Security
Protect your database against user enumeration and other attack vectors that expose sensitive information about registered users.
🚫 Disable User Enumeration
WordPress exposes usernames through URLs like /?author=N. An attacker can change the number N (1, 2, 3...) to discover all registered usernames and then use that information for brute-force attacks.
🔍 How the attack works
The attacker obtains usernames and uses them for password attacks.
🛡️ How SeenSecure blocks it
Returns a 404 error when an enumeration attempt via ?author=N or ?author_name= is detected. It also blocks the REST API endpoint that exposes usernames.
📡 Protect Author in Feeds (RSS/RDF/Atom)
What it's for: besides ?author=N URLs, there's another username-leak path many sites overlook: the RSS, RDF, and Atom feeds WordPress generates automatically. Every feed entry shows the author's public name — and if that public name is identical to the username used to log into the panel, anyone reading the feed gets the real username without scanning anything.
Why this makes brute force easier: a brute-force attack needs two things — a valid username and passwords to try against it. Without the username, the attacker would also have to guess that, multiplying the effort required. Once they get the real username from the feed, they only have one problem left to solve (the password) instead of two, and can launch the attack directly against that specific account.
🔍 When there's risk
Only when an account's «display name publicly as» (Users > Your Profile) is identical to its login username. Many sites leave it this way without realizing it, because that's the default value WordPress fills in when the account is created.
🛡️ How SeenSecure protects it
Checks, only inside feeds, whether the name about to be shown matches that account's real username. If it matches, it shows the site name instead. If they're already different, it doesn't touch anything — the rest of the site keeps showing the author name normally.
How to enable it: SeenSecure > Protections > Database > Protect Author in Feeds (RSS/RDF/Atom). Enabled by default, alongside the ?author=N protection described above. It's an independent switch — you can have one enabled and not the other, though it's recommended to keep both on.
⚙️ Panel & File Settings
Configure additional hardening options to close common attack vectors related to information exposure and unauthorized editing.
🔍 Hide WordPress Version
Removes the <meta name="generator" content="WordPress X.X" /> tag from HTML and RSS feeds. Attackers use the version to look up specific known vulnerabilities.
✏️ Disable File Editor
Disables the theme and plugin editor from the admin panel. Sets the DISALLOW_FILE_EDIT constant to true in wp-config.php. Prevents attackers with admin access from directly modifying PHP files.
🚫 Plugin/Theme Installation
Disables plugin and theme installation, update, and deletion from the admin panel. Useful on managed sites where changes go through a controlled process.
🔗 Remove Generator Meta Tags
Removes the <meta name="generator"> tag that WordPress automatically inserts in <head> and in RSS feeds with the exact version number.
🔌 API Security
Protects XML-RPC and REST API against DDoS amplification attacks, brute force, and user enumeration.
🔒 Restrict REST API
Restricts WordPress REST API access to authenticated users only and controls which endpoints are allowed to prevent reconnaissance.
👤 Disable REST API Users
Blocks the /wp/v2/users endpoint for unauthenticated users, closing a reconnaissance route attackers use to enumerate valid usernames before targeted attacks.
💬 Comments Security
Protect the WordPress comments system against automated spam and injection attacks with intelligent CAPTCHA and activity monitoring.
🧩 CAPTCHA for Comments
Adds a CAPTCHA challenge to the comment form to verify the visitor is human. Available in three modes:
👁️ Visual CAPTCHA
Displays 4 images (for example, a car, a tree, a house, and a flower) and the user must select the correct one. Does not require typing distorted text.
🔢 Math CAPTCHA
Presents a simple math operation (e.g., 7 + 3 = ?). Easy for humans, hard for bots. No image support required.
😀 Emoji CAPTCHA
Asks the user to select the correct emoji from a set. Modern and fun visual experience for visitors.
📊 Stats Dashboard
The system displays real-time statistics on CAPTCHA performance and blocked spam attempts:
🚫 Blocked Today
47
Spam attempts blocked in the last 24 hours
✅ Success Rate
98.7%
Percentage of legitimate comments that pass the CAPTCHA
📦 Total Blocked
12,843
Total spam attempts blocked since activation
Frequently Asked Questions
I got locked out of the panel after hiding wp-admin, what do I do? Use your Emergency Restore URL (the one you copied with your unique key from the Admin Area Hiding card) — it instantly disables the hiding so you can log back in. Save it somewhere safe before enabling the protection, not after: without it there's no other way to recover access short of direct server access.
A plugin stopped uploading images after I enabled "No PHP execution in uploads" That protection prevents PHP files from being EXECUTED inside the uploads folder, not normal files (images, PDFs, etc.) from being uploaded — if a legitimate plugin stops uploading something, check whether it's trying to upload an executable format rather than a normal content file.
Can I enable only some of the protections on this page, not all of them? Yes, each card in the Protections Summary is enabled/disabled independently; you don't need to turn them all on at once.
I disabled XML-RPC and now Jetpack or my WordPress mobile app is broken That's expected: XML-RPC is the protocol used by the official WordPress app, much of Jetpack, and some WooCommerce payment/shipping gateways. If you need any of those tools, turn it back on.