wp-harden

name	wp-harden
description	WordPress security hardening: adds security constants to wp-config.php, writes .htaccess protection rules (xmlrpc block, file browser disable, wp-includes protection), blocks PHP in uploads, disables pingbacks.
metadata	{"type":"security","script":"scripts/hardening/wp-harden.py","requires":"paramiko"}

WP-HARDEN — WordPress Security Hardening

Apply after every restore or on new sites. Run --dry-run first.

Usage

python scripts/hardening/wp-harden.py \
  --host HOST --user USER --password PASS --wp-path PATH \
  --db-host DBHOST --db-user DBUSER --db-pass DBPASS \
  --db-name DBNAME --db-prefix wp_ [--dry-run]

What it applies

Hardening	How
DISALLOW_FILE_EDIT	wp-config.php constant
WP_DEBUG = false	wp-config.php constant
FORCE_SSL_ADMIN	wp-config.php constant
WP includes protection	.htaccess RewriteRule block
xmlrpc.php block	.htaccess <Files> deny
File browsing disable	Options -Indexes
wp-config.php protection	.htaccess <Files> deny
wp-cron lock	.htaccess <Files> deny
PHP block in uploads	uploads/.htaccess
Pingbacks disabled	DB update to closed
File editor disabled	DB option

Idempotent

Safe to run multiple times — checks before inserting, uses markers to avoid duplicate blocks.