WordPress Security Snippet Generator

<?php
/**
 * Hardening snippets.
 *
 * None of this replaces updates, strong passwords and two-factor. It closes
 * the doors that are cheap to close.
 */

/*
 * Put this in wp-config.php instead if you can: a constant there cannot be
 * changed by a plugin, and this file can.
 */
if ( ! defined( 'DISALLOW_FILE_EDIT' ) ) {
	define( 'DISALLOW_FILE_EDIT', true );
}

// Check Jetpack and any mobile app first: both use XML-RPC.
add_filter( 'xmlrpc_enabled', '__return_false' );

/**
 * Stops /?author=1 redirecting to an author archive, which is how a username
 * list is collected before a brute force run.
 */
function my_site_block_author_enumeration() {
	if ( is_admin() ) {
		return;
	}

	// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- reading a public query var.
	if ( ! empty( $_GET['author'] ) && ! is_user_logged_in() ) {
		wp_safe_redirect( home_url(), 301 );
		exit;
	}
}
add_action( 'template_redirect', 'my_site_block_author_enumeration' );

/**
 * Closes the REST users route to logged-out requests.
 *
 * /wp-json/wp/v2/users lists every author, with their slug, to anybody.
 *
 * @param mixed           $result  Current result.
 * @param WP_REST_Server  $server  The server.
 * @param WP_REST_Request $request The request.
 * @return mixed
 */
function my_site_restrict_rest_users( $result, $server, $request ) {
	if ( ! is_null( $result ) ) {
		return $result;
	}

	if ( 0 !== strpos( $request->get_route(), '/wp/v2/users' ) ) {
		return $result;
	}

	if ( is_user_logged_in() ) {
		return $result;
	}

	return new WP_Error(
		'rest_forbidden',
		__( 'Authentication required.', 'my-site' ),
		array( 'status' => 401 )
	);
}
add_filter( 'rest_pre_dispatch', 'my_site_restrict_rest_users', 10, 3 );

/**
 * Replaces the login error with one that does not say whether the username
 * exists.
 *
 * @return string
 */
function my_site_login_error() {
	return __( 'Those details are not correct.', 'my-site' );
}
add_filter( 'login_errors', 'my_site_login_error' );

/**
 * Removes the generator tag and the version from asset URLs.
 *
 * Not real protection, since the version is detectable other ways, but it
 * quietens automated scanning.
 *
 * @param string $src Asset URL.
 * @return string
 */
function my_site_remove_version( $src ) {
	if ( strpos( $src, 'ver=' ) ) {
		$src = remove_query_arg( 'ver', $src );
	}

	return $src;
}
add_filter( 'script_loader_src', 'my_site_remove_version', 9999 );
add_filter( 'style_loader_src', 'my_site_remove_version', 9999 );
remove_action( 'wp_head', 'wp_generator' );
add_filter( 'the_generator', '__return_empty_string' );