Zero-Trust WordPress Security: The Production Hardening Checklist (2026 Edition)

In modern cybersecurity, the Zero-Trust architecture assumes that perimeter defenses can be breached and that every layer—from file system permissions to REST API endpoints—must independently authenticate, validate, and restrict access. This production hardening checklist provides the exact technical steps required to secure WordPress against automated bots, supply-chain vulnerabilities, and privilege escalations.

1. Core wp-config.php Hardening Constants

The first line of defense is securing the WordPress configuration file. Adding these constants to your wp-config.php immediately closes common attacker vectors:

// 1. Disable Theme & Plugin Code Editor in Admin
define( 'DISALLOW_FILE_EDIT', true );

// 2. Prevent Unfiltered HTML for All Users (Even Admins)
define( 'DISALLOW_UNFILTERED_HTML', true );

// 3. Force SSL on Admin Logins & Sessions
define( 'FORCE_SSL_ADMIN', true );

// 4. Block External HTTP Requests Except Whitelisted APIs
define( 'WP_HTTP_BLOCK_EXTERNAL', false );

2. Blocking PHP Execution in /wp-content/uploads/

Over 80% of successful WordPress malware intrusions involve an attacker uploading a hidden .php backdoor into the uploads directory. Since the media library should only ever serve static images, PDF, and video files, you must block direct PHP execution at the web server layer:

For Apache / LiteSpeed (.htaccess inside /wp-content/uploads/):

<FilesMatch "\.(php|phtml|php3|php4|php5|php7|php8|phps|inc|pl|py|cgi)$">
    Order Deny,Allow
    Deny from all
</FilesMatch>

For Nginx (Inside server block):

location ~* ^/wp-content/uploads/.*\.php$ {
    deny all;
    return 403;
}

3. Restricting REST API Exposure & Author Enumeration

By default, WordPress publicly exposes user logins at /wp-json/wp/v2/users and via author archive scans (example.com/?author=1). This gives attackers exact usernames to target with brute-force attacks. Add this snippet to your child theme’s functions.php:

// 1. Block ?author=N scanning
add_action( 'template_redirect', function() {
    if ( is_author() || isset( $_GET['author'] ) ) {
        wp_safe_redirect( home_url(), 301 );
        exit;
    }
} );

// 2. Restrict /wp-json/wp/v2/users to authenticated users only
add_filter( 'rest_endpoints', function( $endpoints ) {
    if ( isset( $endpoints['/wp/v2/users'] ) && ! is_user_logged_in() ) {
        unset( $endpoints['/wp/v2/users'] );
    }
    if ( isset( $endpoints['/wp/v2/users/(?P[\d]+)'] ) && ! is_user_logged_in() ) {
        unset( $endpoints['/wp/v2/users/(?P[\d]+)'] );
    }
    return $endpoints;
} );

4. Production Security Headers & Content Security Policy

Ensure your server enforces cryptographic transport security and prevents clickjacking with these HTTP headers: