<b>New-Site Hardening SOP</b>

<b>New-Site Hardening SOP</b>
The master pre-launch pass. Don't go live until every box is checked.

— Step 1: HTTPS enforced site-wide, HSTS set, mixed content cleared.
— Step 2: Admin account is not named "admin"; 2FA enrolled on it before anything else.
— Step 3: File permissions 755/644, <code>wp-config.php</code> at 640, file editor disabled.
— Step 4: XML-RPC blocked, REST users endpoint locked, enumeration blocked.
— Step 5: Security headers and a baseline CSP deployed.
— Step 6: Login lockout configured, wp-admin IP-restricted where possible.
— Step 7: Off-site backup confirmed working with one test restore.
— Step 8: WAF in blocking mode, uploads directory non-executable.

Run this every time.