--- title: "WP Cerber Security Hardening Options" description: "With WP Cerber Security having so many features, it can replace other single-purpose WordPress security plugins you may have installed. It can set up a maintenance page for when your website is under..." url: https://www.inmotionhosting.com/support/edu/wordpress/wp-cerber-security-hardening-options/ date: 2019-11-04 modified: 2024-03-22 author: "InMotion Hosting Contributor" categories: ["Security", "WordPress Tutorials"] type: post lang: en --- # WP Cerber Security Hardening Options With [WP Cerber Security](/support/email/wp-cerber-security-antispam-bot-detection-settings/) having so many features, it can replace other single-purpose WordPress security plugins you may have installed. It can [set up a maintenance page](/support/edu/wordpress/wp-cerber-restrict-website-access/) for when your website is under construction. It has an [access control list (ACL)](/support/edu/wordpress/how-to-modify-wp-cerber-security-access-lists/) and [custom email notifications](https://www.inmotionhosting.com/support/edu/wordpress/wp-cerber-notifcations/). WP Cerber Security includes many other features as smaller “hardening” options. Below we’ll cover how to enable these settings and what they accomplish. - [Hardening Options](#harden) - [Server Hardening Options](#options) ## Harden WordPress 1. [Log in to WordPress](/support/edu/wordpress/logging-into-wordpress-dashboard/). 2. On the left, hover over **WP Cerber** and click **Dashboard**. 3. Click the **Hardening** tab. 4. Toggle green all hardening options that wouldn’t negatively affect your website. 5. Once your done, **Save Changes**. ### Hardening Options The list below summarizes the possible hardening functions on this page: - Stop user enumeration – Redirect requests for author username queries to a 404 page - Protect admin scripts – Block malicious access to load-scripts.php and load-styles.php - Disable PHP in uploads – Block the ability to run PHP scripts from your media folder - Disable PHP error displaying – Prevent displaying errors which show information that makes your website easier to hack - Disable XML-RPC – Disables the Remote Procedure Calling protocol (recommended if you don’t use [Jetpack](/support/wordpress-hosting-2/what-is-jetpack-for-wordpress)) without you [manually editing the .htaccess file](/support/edu/wordpress/disable-xml-rpc-requests/) - Disable feeds – Deny access to the RSS feed URLs if you don’t have a [WordPress-powered podcast](/support/edu/wordpress/powerpress-podcast-episodes-wordpress/) or encourage visitors to subscribe to your RSS feeds - Stop user enumeration – Block REST API requests to users’ data - Disable REST API – Restrict REST API usage to those specified within the **Allow these namespaces** text field - Logged in users – Allow all logged in users to use REST API - Allow REST for these roles – Restrict REST API usage to specified roles (if **Logged in users** is toggled gray) – *super admin (*[network / multisite](/support/edu/wordpress/what-is-a-wordpress-network-multisite/)*), administrator, editor, author, contributor, subscriber* - Allow these namespaces – Add namespaces for active plugins – *e.g. *[contact-form-7](https://www.inmotionhosting.com/support/edu/wordpress/how-to-use-contact-form-7-to-add-a-form/)*, *[jetpack](https://www.inmotionhosting.com/blog/what-is-jetpack-for-wordpress/) ![WP Cerber Security Hardening Options](https://www.inmotionhosting.com/support/wp-content/uploads/2019/08/wp-cerber-hardening-1024x848.png)*Harden your WordPress Website without breaking anything* ## Harden your Server There are many hardening options for our [Shared Hosting](https://www.inmotionhosting.com/shared-hosting) and Nginx-powered [WordPress Hosting](https://www.inmotionhosting.com/wordpress-hosting) customers: - [Use the latest PHP version](https://www.inmotionhosting.com/support/edu/cpanel/cpanel-multiphp-ini-editor/) for higher server security. - [Strengthen Email Authentication](/support/email/strengthen-overall-email-authentication/) to prevent spam and prevent your emails from being marked as spam. - [Enable Hotlink Protection](https://www.inmotionhosting.com/support/edu/cpanel/hotlink-protect-htaccess/) in cPanel to block other websites from stealing your server resources to share your media elsewhere. - [Enable ModSecurity](/support/security/what-is-modsecurity-and-why-is-it-important/) to protect your website from code injection attacks. - [cPanel Backups](https://www.inmotionhosting.com/support/edu/cpanel/cpanel-backups/) don’t harden your website but are your last line of defense when dealing with [hack recovery](/support/website/backup-and-restore/recovering-from-a-hack/). [VPS Hosting](https://www.inmotionhosting.com/vps-hosting) includes more hardening features via [WebHost Manager (WHM)](/support/edu/whm/log-into-whm/): - [cPHulk Brute Force Protection](/support/edu/whm/enable-cphulk-brute-force-protection/) fights brute force login attempts. - [ClamAV Virus Scanner](/support/edu/cpanel/install-and-configure-clamav/) scans cPanels for and quarantines infected files. - [ConfigServer & Firewall (CSF)](https://www.inmotionhosting.com/support/security/install-csf/) is a stateful firewall with options to permanently enable and disable IP addresses and ports. It replaces [Advanced Policy Firewall (APF)](/support/server/linux/basic-apf-commands/). - [cPanel Security Advisor](/support/edu/cpanel/how-to-scan-your-server-with-the-cpanel-security-advisor/) checks various WHM configurations against best practices with resources to help you. - More [ModSecurity](https://www.inmotionhosting.com/support/security/how-to-change-your-modsecurity-audit-log-level/) configuration is available in WHM. - [Scheduled cPanel backups](/support/edu/cpanel/setup-scheduled-cpanel-backups/) from WHM allow you to concentrate on your work. Set an additional remote storage destination such as Amazon S3 or Google Drive if possible. Have any further questions about security? Contact our [24/7 Live Support](/support/amp/how-to-get-great-technical-support/) for general questions.