Attack surface reduced by 94% across origin Nginx listeners.
/wp-login.php .php inside /wp-content/uploads/ /wp-login.php behind a secret custom slug (e.g. /ghost-login). Bots hitting standard login paths receive an instant 404 at Nginx edge.
<meta name="generator">, WordPress query string versions (?ver=6.x), and cleans headers. Scanners cannot detect CMS version.
xmlrpc.php. Closes connection with zero payload bytes, and automatically sends scanner IP to Fail2ban jail on first offense.
/wp-json/wp/v2/users and ?author=1 query parameters. Prevents bots from discovering admin usernames.
.php file inside /wp-content/uploads/. Neutralizes uploaded backdoors, web shells, and malicious payloads.
X-Frame-Options: SAMEORIGIN to prevent hostile websites from framing your sites in hidden iframes to hijack customer clicks.
max-age=31536000). Prevents SSL-stripping MITM attacks.
../), and hostile query payloads directly in Nginx memory.
/wp-admin/ and secret login URLs strictly to your chosen countries (e.g. GB, US) while leaving public storefronts open globally.
wp_ prefix across all core & 3rd-party plugin tables (e.g. xc7a9_). Fully safe for imported WordPress sites.