Security & Privacy Hardening
Orbit enforces a hardened baseline security posture across WordPress sites by default, disabling common attack vectors and information leakage endpoints.
REST API User Protection
Unauthenticated enumeration of WordPress users via the REST API is disabled by default.
When an unauthenticated request is made to /wp-json/wp/v2/users or /wp-json/wp/v2/users/<id>, Orbit unsets these endpoints to prevent user enumeration attacks.
Re-enabling REST API User Endpoints
If your front-end application or integration requires public user listing endpoints:
add_filter( 'orbit_enable_rest_api_user_endpoints', '__return_true' );Disabling XML-RPC
XML-RPC (xmlrpc.php) is a legacy protocol frequently targeted for brute-force credential stuffing and amplification attacks. Orbit disables XML-RPC by default.
Re-enabling XML-RPC
add_filter( 'orbit_enable_xmlrpc', '__return_true' );Security HTTP Headers
Orbit injects standard security HTTP response headers on every request via the wp_headers filter:
| HTTP Header | Default Value | Description |
|---|---|---|
Cross-Origin-Opener-Policy | same-origin | Isolates top-level document window from cross-origin documents |
Cross-Origin-Resource-Policy | same-origin | Protects assets from cross-origin inclusion |
Referrer-Policy | strict-origin-when-cross-origin | Sends full referrer URL within same origin, origin-only cross-origin |
X-Content-Type-Options | nosniff | Prevents browsers from MIME-sniffing response content types |
X-Frame-Options | SAMEORIGIN | Prevents framing and clickjacking attacks |
Content-Security-Policy | Custom baseline | Permissive Content Security Policy (enforces frame ancestors, source domains) |
Strict-Transport-Security | max-age=31536000; includeSubDomains | Enforces HTTPS connections (applied automatically on SSL sites) |
Customising Security Headers
You can filter or extend the array of security headers using orbit_default_security_headers:
add_filter( 'orbit_default_security_headers', function( array $headers ) {
// Add custom Content Security Policy or update existing headers
$headers['X-Frame-Options'] = 'DENY';
return $headers;
} );Head Link Removal & oEmbed Stripping
Orbit strips unused or unnecessary metadata tags from the <head> markup:
- Windows Live Writer Manifest: Removed (
wlwmanifest_link). - Shortlinks: Removed (
wp_shortlink_wp_head). - REST API Discovery Links: Removed from
<head>and HTTP headers (rest_output_link_wp_head,rest_output_link_header). - oEmbed Discovery: Removed oEmbed discovery links, oEmbed JavaScript host scripts, and oEmbed URL rewrite rules.
Author Page Disabling
Author archive pages (/author/username) can reveal valid WordPress usernames and are rarely needed on brochure or corporate sites.
Orbit disables author archive pages by default, redirecting any requests for author archives back to the site home page.
Re-enabling Author Pages
add_filter( 'orbit_enable_author_pages', '__return_true' );Hiding WordPress Version
Orbit hides the WordPress generator tag in HTML source code and strips version parameters (?ver=x.x.x) from enqueued CSS stylesheets and JavaScript files.
Exposing WordPress Version
add_filter( 'orbit_enable_expose_wordpress_version', '__return_true' );