hardening options

Should I apply the “Website Firewall Protection” hardening

Think of a website like a physical store, hardening is like putting security locks in the doors. Malicious people can still try to break in through the windows, by stealing your keys, by impersonating an admin, etc. A firewall is like asking the police to keep an eye on the business 24 hours, 7 days a week.

If you think your website will be protected enough with just a few locks here and there, then you don’t need to apply the “Website Firewall Protection” hardening. However, if you need more protection, you can look into it and see if the features offered by the Sucuri Firewall are useful to you [1].

Should I apply the “Information Leakage” hardening

You can keep this option disabled. The plugin already prevents the website from leaking some information. This option is an extra step that is most of the time not necessary. We keep this option for backward compatibility purposes.

Should I apply the “Plugin and Theme Editor” hardening

Yes, please apply this hardening. Most of the time, there is no reason to have this WordPress tool enabled. People who want to modify their plugins and/or themes will often download the code, apply the changes in their computer, and then upload the new files to the servers. I cannot think of a good reason to make such changes live in the server.

[1] https://sucuri.net/website-firewall/

The plugin doesn’t provide a firewall service. It indicate that a firewall would help your website’s security.

With “Plugin and Theme Editor” hardening, it will not be possible to modify plugin or theme code through the WP interface. It’s recommended to apply this hardening.