Two simple protections for your website, both on by default. Go to WP Admin → Lodge WP Settings → Security. Only administrators can turn them off.
Options
- Security headers: tells browsers to block a few common attacks. Other websites can’t show your site inside a frame, files are never read as a different type, and websites you link to only see your domain name. Turn this off only if another website needs to show your site in a frame.
- Hide the user list: WordPress lists your user names publicly at /wp-json/wp/v2/users, which helps anyone trying to guess a login. This hides the list from visitors who aren’t logged in. The editor keeps working.
If a security plugin or your host already sends these headers, LodgeWP leaves them as they are.
