WordPress security hardening in one click
Updated September 2026
Relvato's exposure scan lists what anyone can use to learn about or attack your WordPress site — an open XML-RPC endpoint, a public user list, a version number in the page source. For nine of those findings, the run offers a fix right next to the finding: one click switches it off, and Undo switches it back. This page covers what each fix changes, and what Relvato deliberately won't change for you.
Where the fixes are
Open a run of the exposure scan on a WordPress site connected with the Relvato plugin, version 1.7.1 or newer. Each finding Relvato can fix has a “Fix it” button next to “Ignore this warning”.
Click “Fix it”, and the finding shows “Fixed” with an “Undo” button. Run the check again to confirm the finding is gone. “Undo” turns off only that one setting — every other fix you applied stays on.
What each fix changes
Every fix is a setting the Relvato plugin applies on each request. No theme file and no wp-config.php is edited, which is why Undo can put WordPress's default straight back. The table below lists all nine.
What Relvato won't fix for you
A Content-Security-Policy or HSTS header is never added automatically. A wrong CSP blocks your own scripts, payment buttons or embeds, and HSTS can't be taken back quickly once browsers have seen it — both need a person to set them for your site.
The Server header belongs to your web server, not WordPress, so a plugin can't remove it. And readme.html is served by your web server directly, without going through WordPress; deleting it would make the file-integrity check report a missing core file, so “Ignore this warning” is the clean way to quiet that one.
If a fix doesn't clear the finding
Page caches keep serving the old page until they rebuild. Relvato clears the caching plugins it knows — and Cloudflare, through its official WordPress plugin — when it applies a fix, but a CDN cache configured elsewhere can hold the old version for a while. Run the check again later, or purge that cache.
“Hide PHP errors from visitors” is partial by design: errors raised before plugins load can still show. Setting WP_DEBUG_DISPLAY to false in wp-config.php covers those too.
The nine one-click hardening fixes
| Finding | Fix | What changes |
|---|---|---|
| XML-RPC is enabled | Turn off XML-RPC | xmlrpc.php answers 403. Not applied while Jetpack is active, because Jetpack needs it. |
| REST API user enumeration | Hide the public user list | /wp-json/wp/v2/users only answers logged-in users. The block editor keeps working. |
| Username disclosed via author enumeration | Stop username lookups by number | /?author=1 goes to the homepage. Author pages keep working. |
| WordPress version in the generator tag | Remove the WordPress version tag | The generator meta tag is removed from pages and feeds. |
| Software in the X-Powered-By header | Remove the X-Powered-By header | Pages stop announcing the PHP version. |
| Plugin & theme file editor enabled | Turn off the theme and plugin file editor | The same effect as DISALLOW_FILE_EDIT in wp-config.php. |
| Debug output shown to visitors | Hide PHP errors from visitors | display_errors is turned off once plugins load. |
| Missing X-Content-Type-Options, Referrer-Policy or X-Frame-Options | Add safe security headers | Adds only the headers your site doesn't already send. |
| Directory listing on /wp-content/uploads/ | Stop browsing the uploads folder | An empty index.php in each uploads folder without one. Undo removes only the files Relvato added. |
FAQ
Do the fixes change files on my site?
Only one does: stopping directory browsing adds an empty index.php to uploads folders that don't have one, and Undo removes only the files Relvato added. Every other fix is a setting the Relvato plugin applies on each request.
Will turning off XML-RPC break Jetpack or the WordPress app?
Relvato never turns off XML-RPC while Jetpack is active. The WordPress mobile app also uses XML-RPC — if you publish from it, leave that finding alone, or use Undo.
Does it work on sites that aren't WordPress?
The exposure scan runs on any site, but the one-click fixes need the Relvato WordPress plugin, because it's the plugin that applies them.
Can I undo everything at once?
Each fix has its own Undo, so you can keep the ones you want. There's no single switch that turns them all off.