Understanding the Default Security Measures
When using the installation wizard, our plugin automatically activates a set of default security measures to enhance the protection of your website.
Here’s a breakdown of what each setting does and why it’s important:
- Enable plugin auto updates: Keeps your plugins up to date with the latest versions, ensuring you have the newest features and security fixes. This is crucial for closing vulnerabilities that could be exploited by attackers.
- Hide WordPress Generator tag in HTML code: Removes the WordPress version number from your site’s HTML source code. This prevents attackers from easily discovering what version of WordPress you’re using, which could help them exploit known vulnerabilities.
- Hide Windows Live Writer tag in HTML code: Eliminates the Windows Live Writer meta tag from your site’s code. This tag is unnecessary for most users and removing it can help obscure the tools used to manage your site.
- Automatically remove unneeded files: Cleans up unnecessary files from your WordPress installation, reducing clutter and minimizing the risk of leaving sensitive files that could be exploited by hackers.
- Hide PHP version in header (removes “X-Powered-By”): Conceals the PHP version running on your server from the HTTP header. This makes it harder for attackers to target specific PHP vulnerabilities on your site.
- Hide WP Debug: Turns off the debugging mode that could otherwise display sensitive site information to visitors, which could be useful to attackers.
- Disable WP application passwords: Prevents the use of application passwords for WordPress, adding an extra layer of security by limiting access methods that can be potentially exploited.
- Enable Secure Cookies: Activates secure flags for cookies, ensuring they can only be transmitted over encrypted connections (HTTPS). This helps prevent attackers from intercepting sensitive session data.
- Enable the following security headers with default settings: X-Content-Type-Options, X-Frame-Options, Strict-Transport-Security, and Referrer-Policy: These headers add layers of protection against common web attacks like clickjacking, cross-site scripting (XSS), and man-in-the-middle (MITM) attacks. They instruct browsers to enforce security measures when interacting with your content.
By turning on these default settings, the plugin significantly improves your website’s security posture without requiring manual configuration. This ensures that your site is protected from a broad range of common threats and vulnerabilities from the get-go.
