Wordpress Security Settings
=======================================================================================
1).htaccess File
  Add code in .htaccess
  1)Possible Username & Password Disclosure.
  
	<FilesMatch "(^\.|wp-config(-sample)*\.php)">
	Order Deny,Allow
	Deny from all
	</FilesMatch>
	<Files ~ "^\.ht">
	Order allow,deny
	Deny from all
	</Files>

  2)Deny Access To Sensitive Files in WordPress.
  
	Options All -Indexes
	# Protect some other files
	<FilesMatch "(liesmich.html|faq.html|readme.html|license.txt|faq.txt|credits.html|(.*)\.ttf|(.*)\.bak)">
	Order Deny,Allow
	Deny from all
	</FilesMatch>

	<FilesMatch "^.*(error_log|wp-config.php|robots.txt|php.ini|.[hH][tT][aApP].*)$">
	Order deny,allow
	Deny from all
	</FilesMatch>

	<files .htaccess>
	Order allow,deny
	Deny from all
	</files>

	<files install.php>
	Order allow,deny
	Deny from all
	</files>

	<files fantastico_fileslist.txt>
	Order allow,deny
	Deny from all
	</files>

	<files fantversion.php>
	Order allow,deny
	Deny from all
	</files>

  3)WordPress XML-RPC Authentication Bruteforce.

	<Files xmlrpc.php>
	Order Deny,Allow
	Deny from all
	</Files>

  4)Directory Lisitng Enabled.

	<IfModule mod_rewrite.c>
	RewriteEngine On
	RewriteBase /
	#WriteCheckString:1562058044_52870
	RewriteRule .* - [E=HTTP_MOD_REWRITE:On]
	<FilesMatch "">

	<IfModule mod_headers.c>
	Header set Cache-Control "max-age=300, public"
	Header add Strict-Transport-Security "max-age=31415926;includeSubDomains;"
	Header set X-XSS-Protection "1; mode=block"
	Header always append X-Frame-Options DENY
	Header set X-Content-Type-Options nosniff
	</IfModule>
	<IfModule mod_headers.c>
	Header unset Server
	Header set Connection keep-alive
	Header always unset X-Powered-By
	Header unset X-Powered-By
	Header unset X-CF-Powered-By
	Header unset X-Mod-Pagespeed
	Header unset X-Pingback
	</IfModule>
	</FilesMatch>
	</IfModule>

  5)Banner Grabbing.

	<IfModule mod_headers.c>
	Header set Cache-Control "max-age=300, public"
	Header add Strict-Transport-Security "max-age=31415926;includeSubDomains;"
	Header set X-XSS-Protection "1; mode=block"
	Header always append X-Frame-Options DENY
	Header set X-Content-Type-Options nosniff
	</IfModule>

  6)Error Logs Disclosing.

	<FilesMatch error_log>
	Order Allow,Deny
	Deny from all
	</FilesMatch>
--------------------------------------------------------------	
2) wp-config file
	Add code in wp-config file
	
	header_remove("X-Powered-By");
	header('X-Frame-Options: SAMEORIGIN');
=====================================================================================
