Security hardening settings

RankKit SEO includes four small security hardening switches. Each one closes a common, low-risk gap that bots look for: XML-RPC, username discovery, the built-in file editor and the WordPress version number. They are all off by default, and you turn them on from the site audit with one click.

They are not a replacement for a security plugin or a firewall. They are quick fixes for the specific issues the audit reports, and each one can be undone.

The four switches

Switch	Audit issue it fixes	What it does when on
Turn off XML-RPC	XML-RPC is enabled	Turns off XML-RPC, removes every XML-RPC method, drops the X-Pingback header and closes pingbacks and trackbacks on all posts.
Block user enumeration	Usernames can be discovered	For logged-out visitors: redirects /?author=N scans to the home page (301), hides the /wp/v2/users REST endpoints, removes the users sitemap from the WordPress core sitemap and removes the author name and URL from oEmbed data.
Turn off file editing	Theme and plugin file editing is enabled	Defines DISALLOW_FILE_EDIT, which removes the theme and plugin file editors from the WordPress admin.
Hide the WordPress version	The WordPress version is shown in your HTML	Removes the generator meta tag from your pages and empties the generator line WordPress adds to feeds.

All four are part of the free plugin.

What keeps working

• Block user enumeration: author archives (/author/name/) still work, and logged-in users are not affected. The REST user list stays available to logged-in users, so the block editor works as before.
• Turn off file editing: you can still edit theme and plugin files over SFTP or your host's file manager, and you can still install and update plugins.
• Turn off XML-RPC: everything that uses the REST API, including the block editor, keeps working.

Important Leave XML-RPC on if you use the WordPress mobile app, Jetpack or another service that connects to your site over XML-RPC. Turning it off also closes pingbacks and trackbacks on your posts.

Turn a switch on

There is no settings screen for these switches. You turn them on from the audit:

1. Go to RankKit SEO → Site Audit and click Run audit (or Run again).
2. Click the Security category to filter the list.
3. Next to XML-RPC is enabled, Usernames can be discovered, Theme and plugin file editing is enabled or The WordPress version is shown in your HTML, click Fix it.

RankKit SEO turns the switch on, records the change in the Change Log with the note "Audit fix" and re-runs the audit. The issue disappears from the list.

The audit only shows an issue when it finds the problem. For example, if another plugin already turned off XML-RPC, there is nothing to fix and no Fix it button.

An AI agent connected over MCP can apply the same fixes with the fix_audit_issue tool. The change always waits in the Change Log until an administrator approves it.

Undo a switch

1. Go to RankKit SEO → Change Log.
2. Find the entry with the note "Audit fix" for the setting. The field names are security.disable xmlrpc, security.block user enum, security.disable file edit and security.hide version.
3. Click Revert.

The switch is off again from the next page load. Run the audit again to see the issue come back.

If you changed the same setting again after that entry, Revert stops with "This field changed again after this edit. Revert the newer change first, or force it." Revert the newer entry first.

Restoring a backup taken before you applied the fix also turns the switch off, because backups include all RankKit SEO settings.

How the switches interact with wp-config.php

If your wp-config.php already defines DISALLOW_FILE_EDIT, that value wins. RankKit SEO only defines the constant when it is not set yet. To turn the file editor back on in that case, remove or change the line in wp-config.php.

FAQ

Do I need these if I already use a security plugin?

Probably not. Many security plugins have the same options. If your security plugin already handles one of them, the audit will not report it as an issue.

Will blocking user enumeration break my author pages?

No. Only the /?author=N query for logged-out visitors is redirected. Author archive URLs keep working.

Does hiding the WordPress version make my site secure?

It removes one easy clue for bots. Keeping WordPress, plugins and themes up to date matters far more, and the audit reports those updates too.

Are the switches removed when I uninstall RankKit SEO?

Yes. They are RankKit SEO settings, so they stop working when RankKit SEO is deactivated and are deleted when it is uninstalled. See Deactivate or uninstall RankKit SEO.