A live example
How this site is protected, all of it in the open.
If we call ourselves WordPress experts, our own site should prove it first. This site runs on WordPress too. Here is every protection we use and what it stops, along with how you can check it yourself.
Before you start
What's described here is how the protections work. It is not a guide to attacking anything, and it doesn't point out weak spots. Every check uses an ordinary browser and puts no load on the site.
Last updated: 2026-10-20
Less information on show
1. The WordPress version is hidden
What it stops
Once someone knows your version, it's easier to target you with attacks on that version's known weaknesses. Our pages contain nothing that reveals the version.
How to check
Right-click the page, choose "View page source", and search for "generator" or "ver=". You shouldn't find either.
2. Author usernames can't be looked up
What it stops
Out of the box, WordPress lets anyone find out the usernames of the people who post. Usernames are a clue for logging in, so we've made sure they can't be traced.
How to check
Add "/?author=1" to the end of this site's address and open it. You'll be sent back to the home page.
3. No user list from the REST API
What it stops
WordPress has an endpoint that lets anyone pull a list of users from outside. On this site it returns nothing.
How to check
Open "/wp-json/wp/v2/users". You'll see a "not found" message.
4. No readme files
What it stops
The "readme.html" and "license.txt" files that come with WordPress tell people which software you're running. We've deleted both.
How to check
Open "/readme.html" or "/license.txt". You'll get a 404 (page not found).
5. Folder contents aren't listed
What it stops
Depending on server settings, opening a folder can show a list of the files inside. That listing is turned off.
How to check
Open "/wp-content/uploads/". No list of files appears.
6. Fonts are served from our own server
What it stops
With an external font service, information about each visitor is sent to that service every time a page opens. Our font files come from this site's own server, and the page makes no requests to Google. It also makes pages load faster.
How to check
Open your browser's developer tools (F12 on Windows, ⌘+⌥+I on Mac), go to the "Network" tab, reload the page and filter for "google". Nothing comes up.
Entry points closed
7. XML-RPC is off
What it stops
XML-RPC is an old entry point built for connecting older tools. Hardly anything uses it now, but it's often abused for things like password-guessing attacks, so we've switched it off.
How to check
Open "/xmlrpc.php". Access is refused.
8. File editing in the admin area is off
What it stops
WordPress's admin area includes a feature for editing theme and plugin code directly. We've switched that feature off completely, so even if a login were ever compromised, the site couldn't be rewritten from there.
How to check
This is an admin-only screen, so it can't be checked from outside. We describe it here for completeness.
9. Login attempts are limited
What it stops
To block attacks that try password after password, too many failed logins in a row locks login for a while. The error message is also the same either way, along the lines of "the username or password is incorrect", so it never reveals which one was right.
How to check
This is an admin-only feature, so we don't give a way to check it from outside.
10. Two-factor authentication for admins (in progress)
What it stops
Even if a password leaks, nobody can log in without the account owner's own device.
How to check
This is an admin-only feature, so we describe it here only. We'll announce it on this page once it's in place.
Protecting the connection and the page
11. Security headers are set
HSTS
Tells the browser to always connect over an encrypted connection (https). This stops anyone in between from snooping on or tampering with the connection.
CSP (Content Security Policy)
Only scripts from sources this site has approved are allowed to run. If malicious code ever slipped in, it would have a hard time running.
Referrer-Policy
When you go on to another site, it isn't told more than necessary about which page you came from.
Permissions-Policy
Features this site doesn't use, such as the camera, microphone and location, are blocked from the start.
X-Content-Type-Options
Stops the browser from guessing what type a file is, so a script disguised as an image can't run.
Frame protection
This site can't be embedded inside another site. That stops the trick of laying invisible buttons over a page to make you click them.
These are settings that tell the browser how to treat this site. We use the following:
How to check: In the developer tools "Network" tab, reload the page and look at the "Response Headers" for the first item in the list. For a quicker view, enter this site's address at securityheaders.com and it will show you a grade.
12. Cloudflare sits in front
What it stops
Every visit to the site passes through Cloudflare first. Suspicious traffic and floods of traffic (DDoS attacks) are stopped there before they reach the server (a WAF). Malicious bots and unauthorised AI scraping are also limited there.
How to check
If the response headers include "server: cloudflare" or "cf-ray", the request went through Cloudflare.
13. Forms are protected from spam (partly in progress)
What it stops
Our contact form includes a trap that people can't see but bots fall into (a honeypot). A Cloudflare Turnstile check is also on the way. There are no tedious "pick all the images with…" puzzles.
How to check
On the contact form, you'll see the Turnstile check near the send button.
Less to attack, and a record kept
14. Only the plugins we need
How to check
You can't confirm the list itself from outside, but if you open the page source, you shouldn't find traces of any other plugins.
Every extra plugin is one more place a weakness could appear. Here is everything this site uses, and what each one does.
The last two are management tools we use to build and maintain this site. We list them rather than hide them. Both are locked so they only work when logged in as an administrator.
Name
Type
What it does
Bricks
Theme
Page design and display. We use it in place of a heavy page builder.
RYKIT Guard
Our own must-use plugin
The base layer: login limits, XML-RPC off, usernames kept private. We run the same one on every site we look after.
Our own plugin
Plugin
Settings specific to this site: security headers, fonts and display tweaks.
Polylang
Plugin
The Japanese and English versions of this site.
Two Factor
Plugin
Two-factor login for admins.
FluentSMTP
Plugin
Makes sure emails, such as contact form messages, are delivered.
xCloud xSpeed
Plugin
Page caching, so pages display quickly.
mcp-adapter
Plugin
A tool we use to manage and update the site.
Novamira
Plugin
Likewise, a tool we use to build and manage the site.
15. Backups kept away from the server
What it stops
Even if the server fails or is taken over, the site can be restored. A backup is saved every day somewhere other than the server, and we regularly test that it actually restores.
How to check
This can't be checked from outside, so we record the date of the last restore test here.
We publish our speed the same way
As with security, we publish this site's speed as numbers.
- Lighthouse (mobile): performance 95 / accessibility 100
- LCP (time until the main content appears): 2.3 seconds (mobile profile)
- Score in our free security check: 100 (grade A)
- Measured on: 2026-10-20
How well protected is your site?
Many of the items on this page can be checked from outside. The free check looks at them all at once and gives you a score with a plain-language explanation. No email sign-up needed.