Hardening a WordPress Site: A Practical Checklist
Logins, the admin URL, XML-RPC, the REST API and CAPTCHA. What genuinely reduces risk on a WordPress site, and what is mostly security theater.
HTTPS, Security Headers and Firewalls
Mixed content, HSTS, CSP and what a web application firewall actually blocks. Which headers are worth setting, and the one you should not set.