Security
Harden common WordPress attack surface from SiteNivo → Security — sensitive files, XML-RPC, file editor, identity headers, login lockout, and more.
Where to find it
SiteNivo → Security (settings that used to live under Settings → Security hardening are managed here).
Feature reference
| Control | What it does |
|---|---|
| Block sensitive files | Deny public access to install.php, setup-config.php, debug.log, readme.html, license.txt. Writes Apache .htaccess markers when writable, plus PHP 403 fallback. Nginx users see a snippet to copy. |
| Disable XML-RPC | Turns off XML-RPC and removes X-Pingback. Caution: Jetpack / some mobile apps need XML-RPC. |
| Disable theme & plugin file editor | Sets DISALLOW_FILE_EDIT when not already defined — removes Appearance/Plugin Editor. |
| Hide WordPress identity | Remove generator meta, blank RSS/Atom generator signatures, strip ?ver= from scripts/styles, remove RSD + WLW links. |
| Failed login lockout | After 5 failed attempts per IP within 15 minutes, show a generic too-many-attempts message. (Free does not rename wp-login.) |
| Hide login error detail | Customizable generic message on wp-login so usernames are harder to enumerate. |
| Block application passwords for non-admins | Optional; administrators keep app password access. |
| Ignore scanner / probe paths | Keeps Visitor Tracking logs cleaner by skipping known probe URLs. |
Recommended setup
Open Security
Review defaults — many protections default On.
Keep XML-RPC Off unless required
Re-enable only for Jetpack/apps that need it.
Customize the generic login message
Save a clear, non-revealing string.
Save and verify
Confirm the success toast, then spot-check front end, feeds, and wp-login.
Pro backlog
REST blocking for non-authenticated users and hiding Server/PHP signatures are planned for later hardening / Pro work — not in Free yet.