hidden wordpress settings you should tweak for better security and speed

Why Hidden Settings Matter More Than You Think

Most WordPress tutorials focus on flashy themes or top plugins. But when I started diving into the less obvious parts of WordPress, I realized there are hidden settings that massively affect your site's security and speed. Tweaking just a few can take you from average to awesome — without installing another plugin.

If you love subtle upgrades that punch above their weight, you’re going to enjoy this.

1 Disable File Editing From The Dashboard

By default, WordPress allows admins to edit plugin and theme files directly from the dashboard under Appearance > Theme Editor and Plugins > Plugin Editor. Sounds handy, right?

It's actually a hacker’s dream.

If they breach your login (even without full server access), they can inject malware into your theme files instantly. Scary stuff.

Disable this by adding a single line to your wp-config.php file:

define('DISALLOW_FILE_EDIT', true);

Since I started doing this by default on client sites, incidents of dashboard-based attacks have dropped to zero.

2 Limit Post Revisions To Improve Speed

WordPress saves every edit as a new "revision." Over time, especially on big blogs or content-heavy sites, this can bloat your database and slow down queries.

You can limit revisions by adding to your wp-config.php:

define('WP_POST_REVISIONS', 5);

Now WordPress will only keep the latest 5 revisions per post instead of an endless history. Your database (and your hosting bill) will thank you.

3 Change The Default WordPress Database Prefix

Most WordPress installations use the database table prefix wp_. Hackers know this, and many automated SQL injection scripts rely on it.

When setting up a new site, choose a random prefix like:

$wpdb->prefix = 'hgf7k_';

If you're already live, changing the prefix manually takes some care (and a solid backup) but it's one of the smartest moves for defense in depth.

4 Disable Directory Browsing

By default, if a folder has no index file, visitors might see a full list of files in that directory. Bad news for sensitive data leaks.

To disable it, add this to your .htaccess file:

Options -Indexes

It’s a small move that hides your site’s internal structure from prying eyes — a favorite step I always take during hardening audits.

5 Move The wp-config.php File One Level Up

WordPress allows you to move the wp-config.php file one directory above your root. This puts it outside public web access, adding another shield to your vital database credentials.

Simply move the file manually via FTP and WordPress will still find it automatically. Clean and safe!

6 Set Strong Authentication Keys And Salts

WordPress uses authentication keys and salts to secure session cookies. Strong, random values here make it exponentially harder to hijack sessions.

Generate fresh keys using the official WordPress.org salt generator and replace your existing ones in wp-config.php:

https://api.wordpress.org/secret-key/1.1/salt/

Whenever I rebuild old client sites, I make refreshing salts part of my checklist. It’s a silent but deadly defense mechanism.

7 Disable WordPress REST API For Unauthorized Users

While REST API is critical for modern functionality, exposing too much public data can be risky. Especially if you’re not using apps or external services that require it.

Add this to functions.php to restrict access:

add_filter('rest_authentication_errors', function( $result ) {
    if ( ! is_user_logged_in() ) {
        return new WP_Error('rest_cannot_access', 'Unauthorized access', array('status' => 401));
    }
    return $result;
});

In one security review, I found a site leaking email addresses of all users via an open REST endpoint — this little trick locked it down immediately.

8 Force HTTPS For All Admin Sessions

If your site supports SSL (and it absolutely should), force admin sessions to load only over HTTPS for extra safety:

define('FORCE_SSL_ADMIN', true);

It’s one line of code that prevents login credentials from ever being transmitted insecurely — no excuses in 2025 and beyond!

Conclusion Small Tweaks Massive Gains

Most WordPress hacks happen because of overlooked basics, not exotic bugs. By tweaking a few hidden settings, you create serious obstacles for anyone who wants to mess with your site.

Sometimes the best defense isn’t loud or flashy — it’s quietly fortified walls hackers never even realize they’re banging against.

Take a few minutes to apply these hidden WordPress settings, and your site will be safer, faster, and future-proof.