General Settings
The General tab controls external access and security options.
External Access
| Setting | Default | Description |
|---|---|---|
| WP REST API | ✅ Enabled | Controls the WordPress REST API. When disabled, unauthenticated requests are blocked. Logged-in users retain access. |
| XML-RPC | ✅ Enabled | Controls the XML-RPC interface. When disabled, XML-RPC requests are blocked and the X-Pingback header is removed. |
Disabling the REST API may break plugins that depend on it (e.g., Gutenberg, WooCommerce, Jetpack). Test your site after disabling.
Security
| Setting | Default | Description |
|---|---|---|
| Display WordPress version | ✅ Enabled | Shows the WordPress version in the HTML <head>. Disabling hides it from attackers. |
| Display Login error | ✅ Enabled | Shows detailed login error messages. Disabling shows a generic “Login error” message. |
| Display Authentication with email | ✅ Enabled | Allows email-based login. Disabling forces username-only authentication. |
| Disable file editor | ❌ Disabled | Disables the theme/plugin file editor in the admin. Recommended for production. |
| Disable author archives | ❌ Disabled | Redirects ?author=N URLs to the homepage. Prevents user enumeration. |
| Disable Application Passwords | ❌ Disabled | Disables the Application Passwords feature (WordPress 5.6+). |
Last updated on
