Security Options

Hardening

Reduce your site’s attack surface and trim unnecessary output.

Aurora → Settings → Security & Performance → Hardening has three independent toggles. All are off by default except Clean up <head>.

1

Disable XML-RPC

Turn off the XML-RPC endpoint, a common brute-force and pingback-DDoS vector. Leave it on only if you rely on the WordPress mobile app or remote publishing.

2

Disable comments

Turn comments off site-wide — closes them on every post type, hides existing ones, and removes the Comments admin screen and dashboard widget.

3

Clean up <head>

Remove the WordPress generator/version tag, RSD link, WLW manifest, and shortlink meta from your site’s <head>. On by default.