New-Site Hardening SOP

New-Site Hardening SOP
Run this in order before a site ever sees public traffic.

— Step 1: Force HTTPS, install HSTS, redirect all HTTP to HTTPS.
— Step 2: Delete the default 'admin' username; create a named admin with a 20+ char passphrase.
— Step 3: Enforce 2FA on that account immediately.
— Step 4: Disable file editing and file mods in wp-config.
— Step 5: Set directory 755 / file 644 permissions; wp-config to 600.
— Step 6: Disable XML-RPC and user-enumeration via /?author=1.
— Step 7: Deploy the seven security headers.
— Step 8: Install a login lockout policy.
— Step 9: Confirm automatic core security updates are on.

Run this every time.