Hardening WordPress without breaking the things that matter.

Security writing for WordPress tends to swing between two useless extremes: a list of plugins to install, or advice so cautious it would stop the site working. Neither helps the person who has to keep a client site online and uncompromised.

What we cover here is the practical middle: server and application configuration that actually closes attack surface, how to verify a control is working rather than trusting a dashboard toggle, and the trade-offs that come with each choice. Configuration correctness is a recurring thread — a control that is enabled at two layers at once frequently does less than one configured properly, and the failure is usually silent. Where a topic sits at the boundary of security and delivery, such as transport-level configuration, we cover both sides rather than pretending they are separate concerns.