HARDENING
- Disable XML-RPC — breaks remote posting / some apps if you need XML-RPC.
- Disable RSS/Atom feeds — feed readers won’t work.
- REST hardening: remove REST link in HTML head; disable REST for guests. Test headless/REST plugins.
COMMENTS
Disable comments per public post type (checkboxes).
LOGIN REDIRECTS
Role-based login/logout URLs + defaults. Pro-gated on premium Free; full on WordPress.org. Master toggle enables URL fields.
NOT COVERED
Menu visibility, firewall, 2FA, capability editing.
TROUBLESHOOTING
Mobile app issues → XML-RPC/REST; feeds → disable feeds toggle; redirects → toggle, URLs, Pro lock.