Baseline
Hide version noise, disable dashboard file editing, enforce HTTPS where appropriate, and add security headers.
Free feature
WordPress hardeningyou can toggle
Apply a baseline, tighten access, and add Lockdown controls from one WordPress screen. Each setting stays visible so you know what changed.
What it does
Hardening
Bearmor 1.1 groups hardening into Baseline, Access Hardening and Lockdown. Controls include XML-RPC, dashboard file editing, version exposure, HTTPS and headers, REST/user exposure, uploads protection and server-specific rules.
Access hardening
Tighten XML-RPC and REST/user exposure while keeping integrations you actually use.
Uploads protection
Reduce the chance that an uploaded PHP file can be executed as code.
Lockdown
Add stricter controls and an hourly tripwire when the site needs a more defensive profile.
Self-tests
See whether a selected control is active instead of trusting a switch blindly.
Server-aware rules
.htaccess controls apply to Apache and LiteSpeed. Other servers need equivalent host configuration.
Why it is there
What happens without it
Hackers know the default WordPress setup. They exploit these common weaknesses on millions of sites.
XML-RPC amplification
XML-RPC can multiply brute-force attempts. Thousands of passwords per second.
Version as a hint
Exposed version numbers tell attackers which exploits to try.
Dashboard file edits
If they breach admin, they can edit theme files and install a permanent backdoor.
Open directories
Directory browsing exposes the file structure and helps them find holes faster.
We set an appropriate baseline on every site we build or take into care. Hardening is not one universal switch: XML-RPC, REST and server rules can affect integrations, so enable the controls the site can support.
Set on every care-plan site.
Use Bearmor Security on your WordPress
Install the free plugin from WordPress.org. Every feature is free, with no paid plan to unlock.