WordPress Hardening Checklist Generator

Pick your setup, get a customised WordPress hardening checklist in markdown — paste it into your GitHub issue, Notion doc, Confluence page, or agency runbook and work through it. Companion to the WordPress Hardening for Agencies guide.

Not a substitute for reading the guide — the disclaimer applies. All defaults produce a sensible checklist, so you can hit Generate straight away if you're not sure of a knob.

Hosting type Changes which file-permission and wp-config.php items are actionable on your setup. Shared hosting drops the "move wp-config.php above the webroot" item; managed WP hosts collapse the webserver section to "ask your host for evidence".

Webserver Branches the webserver-specific items (rate-limit rules, author-enum block, security headers) to Nginx / Apache / LiteSpeed syntax. Pick "Handled by host" if you don't touch the webserver config directly.

WAF in front of the site Each WAF gets its own configuration item set. Selecting "None" adds a paragraph strongly recommending you add one and naming three reasonable options.

Site type Multisite adds a network-admin section (Super Admin count, network signup, network-activation hygiene). Headless adds a REST API section (endpoint auth, CORS scoping, admin-URL blocking).

Compliance overlay Optional. Appends a compliance-mapped section only if you pick one. Items map WordPress-specific controls to obligations under the named framework — not legal advice, use as a starting point.