---
title: Activate Default Security Measures
canonical: https://wpsecurityninja.com/docs/installation-and-usage/activate-default-security-measures/
---
On Pro, the [Installation Wizard](https://wpsecurityninja.com/docs/installation-and-usage/installation-wizard/) can apply a recommended set of Fixes in one step. You can change any of these later under **Security Ninja → Fixes**.

![Default security measures in the Installation Wizard](https://wpsecurityninja.com/media/2026/07/install-wizard/install-wizard-default-fixes.jpg)

## What Activate turns on

<dl class="docs-term-list docs-term-list--stacked">
<dt>Hide WordPress Generator tag</dt>
<dd>Removes the WordPress version from HTML so attackers cannot target a known release as easily.</dd>
<dt>Hide Windows Live Writer tag</dt>
<dd>Removes an unused meta tag from the HTML head.</dd>
<dt>Hide PHP version in headers (removes X-Powered-By)</dt>
<dd>Stops the server from advertising the PHP version in HTTP headers when the plugin can control that output.</dd>
<dt>Hide WP Debug</dt>
<dd>Turns off debug output that can leak site details to visitors.</dd>
<dt>Disable username enumeration</dt>
<dd>Blocks common tricks that reveal valid usernames.</dd>
<dt>Disable XML-RPC</dt>
<dd>Turns off XML-RPC, which is a frequent brute-force and abuse target if you do not need it.</dd>
<dt>Disable application passwords</dt>
<dd>Turns off WordPress application passwords as an alternate login method.</dd>
<dt>Remove unneeded files</dt>
<dd>Removes leftover readme and license files from web-accessible plugin and theme locations when the fix can do so safely.</dd>
<dt>Enable secure cookies</dt>
<dd>Marks cookies secure so they are only sent over HTTPS.</dd>
<dt>Enable default security headers</dt>
<dd>Adds X-Content-Type-Options, X-Frame-Options, Strict-Transport-Security, and Referrer-Policy with sensible defaults.</dd>
</dl>

These options are Pro Fixes. Free users finish the wizard without this step. Review the list after Activate if your site needs XML-RPC, application passwords, or different header values.