functions.php

<?php

/**
 * Basic WordPress security hardening tweaks.
 *
 * This is a lightweight, non-invasive set of improvements focused on reducing
 * common attack vectors and limiting unnecessary exposure of internal data.
 * It does NOT replace proper security measures like rate limiting, WAF, or 2FA.
 *
 * Included protections:
 * - Custom login URL (obscures default wp-login.php access)
 * - Hides WordPress version information
 * - Generic login error message (prevents user enumeration)
 * - Disables emojis (performance + minor surface reduction)
 * - Blocks user listing via REST API (/wp-json/wp/v2/users)
 * - Disables XML-RPC
 * - Prevents user enumeration via ?author=1
 *
 *                         ▗▖  ▗▖ ▄▄▄   ▄▄▄▄▄▄▄▖ ▄▄▄ ▄▄▄  ▄▄▄▄   ▄▄▄
 *  Code is part of        ▐▛▚▖▐▌█   █ ▀▄▄  ▐▌  █   █   █ █ █ █ █   █
 *  monitoring.apposto.pl  ▐▌ ▝▜▌▀▄▄▄▀ ▄▄▄▀ ▐▌  █   ▀▄▄▄▀ █   █ ▀▄▄▄▀
 */

// --- Block access to wp-login.php and wp-admin (for non-logged users)
define('CUSTOM_LOGIN_SLUG', 'my-login');

add_action('init', function () {
    $request = $_SERVER['REQUEST_URI'];
    $path = parse_url($request, PHP_URL_PATH);

    // Block direct access to wp-login.php
    if (basename($path) === 'wp-login.php') {
        status_header(404);
        nocache_headers();
        exit;
    }

    // Restrict wp-admin for unauthenticated users (without breaking AJAX/CRON)
    if (
        is_admin() &&
        !is_user_logged_in() &&
        !defined('DOING_AJAX') &&
        !defined('DOING_CRON')
    ) {
        wp_redirect(home_url('/' . CUSTOM_LOGIN_SLUG));
        exit;
    }
});

add_action('init', function () {
    $request = trim(parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH), '/');

    // Route custom login URL to default login handler
    if ($request === CUSTOM_LOGIN_SLUG) {
        require_once ABSPATH . 'wp-login.php';
        exit;
    }
});

// --- Hide WordPress version
remove_action('wp_head', 'wp_generator');
add_filter('the_generator', '__return_empty_string');

function remove_wp_version_strings($src) {
    global $wp_version;
    parse_str(parse_url($src, PHP_URL_QUERY), $query);

    if (isset($query['ver']) && $query['ver'] === $wp_version) {
        $src = remove_query_arg('ver', $src);
    }
    return $src;
}
add_filter('script_loader_src', 'remove_wp_version_strings');
add_filter('style_loader_src', 'remove_wp_version_strings');


// --- Hide login errors (prevent username disclosure)
add_filter('login_errors', function(){ return 'Invalid login credentials'; });

// --- Remove unnecessary meta tags
remove_action('wp_head', 'wlwmanifest_link');
remove_action('wp_head', 'rsd_link');
remove_action('wp_head', 'wp_shortlink_wp_head');
remove_action('wp_head', 'adjacent_posts_rel_link_wp_head', 10, 0);
remove_action('wp_head', 'feed_links', 2);
remove_action('wp_head', 'feed_links_extra', 3);

// --- Disable emojis
remove_action('wp_head', 'print_emoji_detection_script', 7);
remove_action('wp_print_styles', 'print_emoji_styles');

// --- Block users endpoint in REST API
add_filter('rest_endpoints', function ($endpoints) {
    unset($endpoints['/wp/v2/users']);
    unset($endpoints['/wp/v2/users/(?P<id>[\d]+)']);
    return $endpoints;
});

// --- Prevent user enumeration via ?author=1
add_action('init', function () {
    if (!is_admin() && isset($_GET['author'])) {
        wp_redirect(home_url('/'), 302);
        exit;
    }
});

// --- Remove users from sitemap
function remove_author_category_pages_from_sitemap($provider, $name)
{
    if ('users' === $name) {
        return false;
    }
    return $provider;
}
add_filter('wp_sitemaps_add_provider', 'remove_author_category_pages_from_sitemap', 10, 2);

// --- Disable XML-RPC
add_filter('xmlrpc_enabled', '__return_false');
add_filter('wp_headers', function($h){ unset($h['X-Pingback']); return $h; });