Understanding the Default Security Measures
When using the installation wizard, our plugin automatically activates a set of default security measures to enhance the protection of your website.
Here’s a breakdown of what each setting does and why it’s important:
- Hide WordPress Generator tag in HTML code
- Removes the WordPress version from HTML so attackers can’t easily target known vulnerabilities.
- Hide Windows Live Writer tag in HTML code
- Removes an unused meta tag and helps obscure the tools used to manage your site.
- Automatically remove unneeded files
- Cleans leftover files that could expose sensitive data if left on the server.
- Hide PHP version in header (removes “X-Powered-By”)
- Stops the server from advertising its PHP version in HTTP headers.
- Hide WP Debug
- Turns off debug output that could reveal sensitive site information to visitors.
- Disable WP application passwords
- Limits alternate login methods that can be abused if credentials leak.
- Enable Secure Cookies
- Marks cookies secure so they are only sent over HTTPS.
- Enable default security headers
- Adds X-Content-Type-Options, X-Frame-Options, Strict-Transport-Security, and Referrer-Policy to help block clickjacking, XSS, and MITM attacks.
By turning on these default settings, the plugin significantly improves your website’s security posture without requiring manual configuration. This ensures that your site is protected from a broad range of common threats and vulnerabilities from the get-go.