Kadence Security settings we use on every site

Install and first run

1. In your dashboard go to Plugins > Add New Plugin, search for Kadence Security and click Install Now, then Activate. (In the WordPress.org directory its address is still better-wp-security, from its iThemes days.)
2. The setup wizard asks what kind of site you run. Pick the closest match; it only chooses sensible starting values. You can change every one of them afterwards.
3. Everything below lives under Security > Settings, grouped into Features, User Groups, Notifications and Advanced.

Site scan: on, and scheduled

Setting	Our choice	Why
Site Scan	Run it now, then on a schedule	The scan checks your WordPress version, plugins and themes against a database of known vulnerabilities and checks your site against Google's list of unsafe sites. It is the quickest way to learn that a plugin you rely on has a published security hole.
Features > Site Check > Scheduled Site Scan	On (it scans twice a day)	A scan you have to remember to run is a scan that does not get run. The schedule e-mails you only when it finds something.

Two-factor login (2FA): on for every administrator

Setting	Our choice	Why
Features > Login Security > Two-Factor	On	A stolen or guessed password is still the most common way into a WordPress site. With 2FA the attacker also needs the six-digit code from your phone.
Authentication Methods Available to Users	All methods (Mobile App, E-mail, Backup Codes)	An authenticator app (Google Authenticator, Microsoft Authenticator, Authy, 1Password and so on) is the strongest. E-mail codes are the easy fallback, and backup codes get you in if you lose your phone. Print them or keep them in your password manager.
Users > Profile > Two-Factor Authentication (every administrator and editor)	Set up the mobile app	The accounts that can install plugins or change content must have 2FA. In the free plugin each person turns it on in their own profile: scan the QR code with the app and save the backup codes. Forcing 2FA for a whole user group (Require Two-Factor) is a Kadence Security Pro feature.
Disable on First Login	Off	Leaving this off means new accounts are protected from the very first login.

Lockout notifications: off

Kadence Security locks out an address after repeated failed logins (Features > Login Security > Local Brute Force: 5 attempts per IP and 10 per user within 5 minutes are good values). The lockouts are what protect you. The e-mail about each one is not.

Setting	Our choice	Why
Notifications > Site Lockouts	Off	Every public WordPress site is hit by login bots all day. With lockout e-mails on you get dozens of alarming messages that need no action, and you soon stop reading security e-mails at all, including the ones that matter. The lockouts still happen and are listed under Security > Logs.
Notifications > Security Digest	Off, or weekly	The digest is a summary of the same lockouts. Turn it on weekly only if you like a routine report.
Notifications > Site Scan Results	On	This is the e-mail you do want: it arrives only when the scheduled scan finds a problem.

Move wp-admin: Hide Backend

Every WordPress site answers at /wp-admin/ and /wp-login.php, so bots try those addresses on millions of sites. Advanced > Hide Backend gives your login page a private address instead.

Setting	Our choice	Why
Hide Backend	On	Bots that blindly post passwords to wp-login.php get a "not found" page instead of a login form. That removes most of the login noise and the server load that comes with it.
Login Slug	Something you will remember but nobody will guess, for example team-entrance (not login or admin)	Your login page becomes yoursite.com/team-entrance. Bookmark it, and tell anyone else who logs in.
Enable Redirection / Redirection Slug	On, default not_found	Visitors to the old /wp-admin/ address are sent to a harmless "not found" page rather than to your real login.

Author URLs off

By default WordPress publishes an author page for every user, at an address such as /author/admin/, and yoursite.com/?author=1 redirects there. That address contains the user's login name. Give an attacker your login name and half of the guessing work is done.

Setting	Our choice	Why
Features > WordPress Tweaks > Disable Extra User Archives	On	Removes author pages for users who have not published anything, which usually includes the administrator account.
Force Unique Nickname	On	Makes each user's public display name different from the login name, so posts and comments do not reveal it either.
REST API	Restricted Access	Stops anonymous visitors from listing your users through /wp-json/wp/v2/users, another common way to harvest login names. If a form, map or booking plugin stops working for visitors afterwards, switch back to Default Access and ask the plugin author.
Yoast SEO > Settings > Advanced > Author archives	Disabled	On a business site with one or two authors the author archive is a duplicate of the blog. Turning it off in Yoast removes it entirely and keeps it out of your sitemap. See our Yoast settings.

Other settings we turn on

Setting	Our choice	Why
WordPress Tweaks > Disable File Editor	On	Removes the theme and plugin code editor from the dashboard, so a hijacked admin account cannot paste malicious code into your site.
WordPress Tweaks > XML-RPC	Disable, unless you use the Jetpack plugin or the WordPress mobile app	XML-RPC is an old remote-publishing door that bots use to try many passwords in one request.
System Tweaks > Protect System Files, Disable Directory Browsing, Disable PHP in Uploads	On	Blocks direct access to files such as wp-config.php and stops uploaded files from ever running as code.
Ban Users and Firewall	On, default values	Repeat offenders are banned automatically.

If you lock yourself out

• Forgot your Hide Backend address? Using your host's file manager or FTP, rename the folder wp-content/plugins/better-wp-security to better-wp-security-off. WordPress deactivates the plugin and the normal /wp-login.php works again. Log in, rename the folder back, reactivate the plugin and check the slug under Advanced.
• Lost your phone? Use one of your 2FA backup codes, or ask another administrator to reset your two-factor settings from your user profile.
• Locked out by your own failed logins? Wait for the lockout period to end (15 minutes by default), or log in from another network.