Why Out-of-the-Box WordPress Is Completely Insecure

<?php
/**
 * Prevent author enumeration via query string and redirect loop.
 *
 * Hooked early on 'template_redirect' to stop WordPress before
 * it performs any author-archive query that leaks login slugs.
 *
 * @return void
 */
function oda_prevent_author_enumeration(): void {
    // phpcs:ignore WordPress.Security.NonceVerification.Recommended
    if ( ! \is_admin() && isset( $_GET['author'] ) ) {
        \wp_safe_redirect( home_url( '/' ), 301 );
        exit;
    }
}
\add_action( 'template_redirect', 'oda_prevent_author_enumeration', 1 );

<?php
/**
 * Remove the 'author' field and restrict the /wp/v2/users endpoint
 * to authenticated requests with 'list_users' capability.
 *
 * @param array           $args    Endpoint registration args.
 * @param string          $route   The REST route being registered.
 * @param WP_REST_Request $request The current request (unused here).
 * @return array Modified args.
 */
function oda_restrict_rest_user_endpoint( array $args, string $route ): array {
    if ( false !== strpos( $route, '/wp/v2/users' ) ) {
        $args['permission_callback'] = static function (): bool {
            return current_user_can( 'list_users' );
        };
    }
    return $args;
}
\add_filter( 'rest_endpoints', 'oda_restrict_rest_user_endpoint', 10, 2 );

/**
 * Strip the 'author_name' field from post response objects so that
 * authenticated reads still cannot be used to harvest usernames.
 *
 * @param WP_REST_Response $response The REST response.
 * @param WP_Post          $post     The post object.
 * @param WP_REST_Request  $request  The request.
 * @return WP_REST_Response
 */
function oda_remove_author_from_rest_posts(
    WP_REST_Response $response,
    WP_Post $post,          // phpcs:ignore VariableAnalysis.CodeAnalysis.VariableAnalysis.UnusedVariable
    WP_REST_Request $request // phpcs:ignore VariableAnalysis.CodeAnalysis.VariableAnalysis.UnusedVariable
): WP_REST_Response {
    $data = $response->get_data();
    unset( $data['author'] );
    $response->set_data( $data );
    return $response;
}
\add_filter( 'rest_prepare_post', 'oda_remove_author_from_rest_posts', 10, 3 );

<?php
/**
 * Disable the XML-RPC endpoint entirely.
 *
 * This is safe for the vast majority of sites. Only re-enable if you
 * actively use a remote publishing client that requires it (e.g. Jetpack
 * ping-backs, legacy mobile apps). Prefer the REST API for modern integrations.
 *
 * @return false
 */
\add_filter( 'xmlrpc_enabled', '__return_false' );

/**
 * Also block xmlrpc.php at the PHP level as a defence-in-depth measure,
 * because the 'xmlrpc_enabled' filter only fires after WordPress loads.
 * Put the block below in your .htaccess (Apache) or server block (Nginx).
 */

<?php
/**
 * Remove the system.multicall and system.listMethods XML-RPC methods
 * to prevent credential-stuffing amplification attacks while still
 * allowing legitimate single-method remote publishing calls.
 *
 * @param array $methods Registered XML-RPC methods.
 * @return array Filtered method list.
 */
function oda_remove_xmlrpc_multicall( array $methods ): array {
    unset(
        $methods['system.multicall'],
        $methods['system.listMethods'],
        $methods['system.getCapabilities']
    );
    return $methods;
}
\add_filter( 'xmlrpc_methods', 'oda_remove_xmlrpc_multicall' );

<?php
/**
 * Require authentication for all REST API requests.
 *
 * This approach is appropriate for non-public REST usage (e.g. headless/SPA
 * backends where the front-end handles auth). Do NOT use this if your theme
 * or plugins depend on unauthenticated REST calls for public content delivery.
 *
 * @param WP_Error|null|true $result Current authentication result.
 * @return WP_Error|null|true
 */
function oda_rest_require_authentication( $result ) {
    if ( null !== $result ) {
        // Another authentication handler already ran.
        return $result;
    }

    if ( ! is_user_logged_in() ) {
        return new WP_Error(
            'rest_not_logged_in',
            __( 'You must be authenticated to access the REST API.', 'oda-security' ),
            array( 'status' => rest_authorization_required_code() )
        );
    }

    return $result;
}
\add_filter( 'rest_authentication_errors', 'oda_rest_require_authentication' );

<?php
/**
 * Unregister the /wp/v2/users endpoint for unauthenticated requests.
 *
 * Prefer this over blanket REST disabling when your site uses the REST API
 * for other public data (e.g. posts, categories, custom post types).
 *
 * @param array $endpoints Registered REST endpoints.
 * @return array
 */
function oda_remove_rest_users_endpoint( array $endpoints ): array {
    $restricted = array(
        '/wp/v2/users',
        '/wp/v2/users/(?P<id>[\d]+)',
    );

    foreach ( $restricted as $route ) {
        if ( isset( $endpoints[ $route ] ) && ! current_user_can( 'list_users' ) ) {
            unset( $endpoints[ $route ] );
        }
    }

    return $endpoints;
}
\add_filter( 'rest_endpoints', 'oda_remove_rest_users_endpoint' );

<?php
/**
 * wp-config.php — hardened configuration template.
 *
 * @package WordPress
 */

// ── Database credentials ──────────────────────────────────────────────────────
define( 'DB_NAME',      getenv( 'WP_DB_NAME' )     ?: 'your_db_name' );
define( 'DB_USER',      getenv( 'WP_DB_USER' )     ?: 'your_db_user' );
define( 'DB_PASSWORD',  getenv( 'WP_DB_PASSWORD' ) ?: 'your_db_password' );
define( 'DB_HOST',      getenv( 'WP_DB_HOST' )     ?: '127.0.0.1' );
define( 'DB_CHARSET',   'utf8mb4' );
define( 'DB_COLLATE',   'utf8mb4_unicode_520_ci' );

// ── Unique keys and salts — ALWAYS generate fresh ones ───────────────────────
// Generate at: https://api.wordpress.org/secret-key/1.1/salt/
define( 'AUTH_KEY',         'REPLACE_WITH_UNIQUE_VALUE' );
define( 'SECURE_AUTH_KEY',  'REPLACE_WITH_UNIQUE_VALUE' );
define( 'LOGGED_IN_KEY',    'REPLACE_WITH_UNIQUE_VALUE' );
define( 'NONCE_KEY',        'REPLACE_WITH_UNIQUE_VALUE' );
define( 'AUTH_SALT',        'REPLACE_WITH_UNIQUE_VALUE' );
define( 'SECURE_AUTH_SALT', 'REPLACE_WITH_UNIQUE_VALUE' );
define( 'LOGGED_IN_SALT',   'REPLACE_WITH_UNIQUE_VALUE' );
define( 'NONCE_SALT',       'REPLACE_WITH_UNIQUE_VALUE' );

// ── Custom database table prefix (see §07) ────────────────────────────────────
$table_prefix = 'zx9k_'; // Never use the default 'wp_'

// ── Security constants ────────────────────────────────────────────────────────
define( 'DISALLOW_FILE_EDIT',   true );  // Block theme/plugin editor in admin
define( 'DISALLOW_FILE_MODS',   false ); // Set true to prevent plugin/theme installs via admin
define( 'FORCE_SSL_ADMIN',      true );  // Always use HTTPS for wp-admin and wp-login
define( 'WP_AUTO_UPDATE_CORE',  true );  // Allow minor core security updates automatically

// ── Debug settings — NEVER enable on production ──────────────────────────────
define( 'WP_DEBUG',         false );
define( 'WP_DEBUG_LOG',     false );
define( 'WP_DEBUG_DISPLAY', false );
define( 'SCRIPT_DEBUG',     false );
@ini_set( 'display_errors', '0' ); // phpcs:ignore WordPress.PHP.IniSet.display_errors_Disallowed

// ── Limit post revisions to reduce DB bloat ──────────────────────────────────
define( 'WP_POST_REVISIONS', 5 );

// ── Absolute path ─────────────────────────────────────────────────────────────
if ( ! defined( 'ABSPATH' ) ) {
    define( 'ABSPATH', __DIR__ . '/' );
}

require_once ABSPATH . 'wp-settings.php';

<?php
/**
 * Set a unique, unpredictable table prefix in wp-config.php.
 * Use 3–6 lowercase letters and/or digits followed by an underscore.
 * Avoid words that hint at WordPress (wp_, wordpress_, blog_).
 *
 * For EXISTING installations, use a plugin such as "Change Table Prefix"
 * or the WP-CLI command below — do NOT change this value manually after
 * installation without also renaming all tables and updating user_meta keys.
 */
$table_prefix = 'zx9k_'; // Example — generate your own random string

<?php
/**
 * Correct: Use $wpdb->prepare() for ALL dynamic queries.
 *
 * @param int    $user_id     Authenticated user ID from current_user_can() check.
 * @param string $post_status Post status to filter by.
 * @return array|object|null  Query results.
 */
function oda_get_user_posts( int $user_id, string $post_status ): array {
    global $wpdb;

    // Whitelist the status value — do NOT pass arbitrary user input here.
    $allowed_statuses = array( 'publish', 'draft', 'pending', 'private' );
    if ( ! in_array( $post_status, $allowed_statuses, true ) ) {
        return array();
    }

    // %d = integer placeholder, %s = string placeholder.
    // prepare() adds its own quoting; never add extra quotes around placeholders.
    $query = $wpdb->prepare(
        "SELECT ID, post_title, post_date
         FROM {$wpdb->posts}
         WHERE post_author = %d
           AND post_status = %s
         ORDER BY post_date DESC
         LIMIT 50",
        $user_id,
        $post_status
    );

    // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared -- query IS prepared above
    return $wpdb->get_results( $query );
}

/**
 * WRONG — never do this:
 *
 * $wpdb->query( "SELECT * FROM {$wpdb->posts} WHERE ID = " . $_GET['id'] );
 * //                                                          ^^^^^^^^^^^
 * //                                                          Direct injection point
 */

<?php
/**
 * Simple transient-based login rate limiter.
 *
 * Locks out an IP after 5 failed attempts within a 15-minute window.
 * For production sites prefer a dedicated plugin (e.g. Wordfence, Limit
 * Login Attempts Reloaded) which handles edge cases and IPv6 correctly.
 *
 * @param WP_Error $errors     WP_Error object from the login form.
 * @param string   $user_login The attempted username.
 * @return void
 */
function oda_login_rate_limit( WP_Error $errors, string $user_login ): void { // phpcs:ignore VariableAnalysis.CodeAnalysis.VariableAnalysis.UnusedVariable
    $ip            = sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ?? '' ) );
    $transient_key = 'login_fail_' . md5( $ip );
    $attempts      = (int) \get_transient( $transient_key );
    $max_attempts  = 5;
    $lockout_secs  = 15 * MINUTE_IN_SECONDS;

    if ( $attempts >= $max_attempts ) {
        $errors->add(
            'too_many_attempts',
            __( 'Too many failed login attempts. Please try again in 15 minutes.', 'oda-security' )
        );
        // Short-circuit the rest of the login process.
        \wp_die(
            \esc_html( $errors->get_error_message( 'too_many_attempts' ) ),
            \esc_html__( 'Login Blocked', 'oda-security' ),
            array( 'response' => 429 )
        );
    }
}
\add_action( 'wp_login_failed', 'oda_increment_login_fail_count', 10, 1 );
\add_filter( 'authenticate', 'oda_login_rate_limit', 30, 2 );

/**
 * Increment the failure counter after each failed authentication.
 *
 * @param string $username The username that failed.
 * @return void
 */
function oda_increment_login_fail_count( string $username ): void { // phpcs:ignore VariableAnalysis.CodeAnalysis.VariableAnalysis.UnusedVariable
    $ip            = \sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ?? '' ) );
    $transient_key = 'login_fail_' . md5( $ip );
    $attempts      = (int) \get_transient( $transient_key );
    \set_transient( $transient_key, $attempts + 1, 15 * MINUTE_IN_SECONDS );
}

<?php
/**
 * Replace WordPress login error messages with a generic message.
 *
 * By default WordPress tells attackers "Incorrect password for user admin"
 * confirming that the username exists. This filter returns the same message
 * regardless of whether the username or the password was wrong.
 *
 * @param string $error The original error message HTML.
 * @return string
 */
function oda_generic_login_error( string $error ): string { // phpcs:ignore VariableAnalysis.CodeAnalysis.VariableAnalysis.UnusedVariable
    return '<strong>ERROR</strong>: Invalid username or password.';
}
\add_filter( 'login_errors', 'oda_generic_login_error' );

<?php
/**
 * Production-safe debug configuration.
 *
 * Errors are logged to a file OUTSIDE the web root, never displayed.
 * The log file path must not be web-accessible.
 */

// Never true in production.
define( 'WP_DEBUG', false );

// Log to a file instead of outputting to screen.
define( 'WP_DEBUG_LOG',     '/var/log/wordpress/debug.log' );

// Never display errors to end users.
define( 'WP_DEBUG_DISPLAY', false );

// Suppress PHP notices and warnings from reaching output buffers.
@ini_set( 'display_errors', '0' ); // phpcs:ignore WordPress.PHP.IniSet.display_errors_Disallowed
@ini_set( 'log_errors',     '1' ); // phpcs:ignore WordPress.PHP.IniSet.log_errors_Disallowed
@ini_set( 'error_log', '/var/log/wordpress/php-error.log' ); // phpcs:ignore WordPress.PHP.IniSet

<?php
/**
 * Silence is golden.
 *
 * Place this file in:
 *   wp-content/index.php
 *   wp-content/plugins/index.php
 *   wp-content/themes/index.php
 *   wp-content/uploads/index.php
 *
 * WordPress ships with some of these already, but third-party theme and
 * plugin installation processes often create subdirectories without them.
 * A deployment script should ensure every new directory gets one.
 */
// Intentionally empty.

<?php
/**
 * Remove all default WordPress version fingerprinting.
 *
 * @package ODA_Security
 */

// Remove <meta name="generator" content="WordPress x.x.x" /> from <head>.
\remove_action( 'wp_head', 'wp_generator' );

// Remove version from RSS/Atom feeds.
\add_filter( 'the_generator', '__return_empty_string' );

/**
 * Strip the ?ver= query string from enqueued scripts and styles.
 *
 * Note: This only removes version fingerprinting from the *output*.
 * It does not affect how WordPress tracks asset cache-busting internally.
 *
 * @param string $src The script or style source URL.
 * @return string URL without ?ver= parameter.
 */
function oda_remove_version_from_assets( string $src ): string {
    if ( strpos( $src, 'ver=' ) !== false ) {
        $src = \remove_query_arg( 'ver', $src );
    }
    return $src;
}
\add_filter( 'style_loader_src',  'oda_remove_version_from_assets', 9999 );
\add_filter( 'script_loader_src', 'oda_remove_version_from_assets', 9999 );

/**
 * Delete readme.html and license.txt from the web root on activation.
 *
 * These files expose the WordPress version on their first line and serve
 * no operational purpose on a live site.
 */
function oda_remove_fingerprint_files(): void {
    $files = array(
        ABSPATH . 'readme.html',
        ABSPATH . 'license.txt',
        ABSPATH . 'wp-admin/install.php', // After installation is complete.
    );

    foreach ( $files as $file ) {
        if ( file_exists( $file ) ) {
            \wp_delete_file( $file );
        }
    }
}
\register_activation_hook( __FILE__, 'oda_remove_fingerprint_files' );