# Protect a WordPress site

Turn on a firewall, block bad bots, harden WordPress and protect the sign-in page from a WordPress site’s Security tab.

## Before you start

- A WordPress site in Nuvlo.
- Permission to manage sites.

## Step 1: Open the Protection card

Open the site and click **Security**. The **Protection** card is at the top.

![Security tab with the Protection card: Firewall choice and Traffic, WordPress hardening and Sign-in switches](https://app.nuvlo.dev/docs/shots/wordpress-security--protection.webp)

## Step 2: Choose the firewall rules

| Choice | What it does |
| --- | --- |
| **8G** (Recommended) | Newest rules. Blocks SQL injection, script injection, path traversal and scanners. |
| **7G** | The earlier rule set with fewer checks. Use it if 8G blocks something your site needs. |
| **Off** | No firewall rules. Requests go straight to WordPress. |

## Step 3: Turn on the protections you need

| Switch | What it does |
| --- | --- |
| **Block bad bots** | Turns away SEO scrapers and hacking tools. |
| **Block spam referrers** | Turns away visits sent from known spam sites. |
| **Security headers** | Tells browsers to use HTTPS only and not to load the site inside other sites. |
| **Turn off XML-RPC** | Closes a common target for password guessing. The Jetpack plugin and the old WordPress app need it. |
| **Restrict the REST API** | Only signed-in users can use it. Can break plugins that load content for visitors through it. On a headless site, leave it off unless your frontend signs its requests: the frontend loads its content through the REST API. |
| **Block PHP in uploads** | Uploaded files can’t run as code. |
| **Limit sign-in attempts** | Locks out an IP address for 15 minutes after 5 wrong passwords. |
| **Move the sign-in page** | Replaces /wp-admin and /wp-login.php with an address only you know. Enter it in **New sign-in address**. |
| **Password-protect the site** | Everyone needs a username and password before the site loads, for example while you build it. Enter **Username** and **Password**. |

## Step 4: Save and apply

Click **Save and apply**. The button shows **Saved** once nothing is left to save.

If the server couldn’t be reached, the card shows what a new site starts with. Saving applies those settings.

## More on this tab

**Malware scan** checks WordPress core files against the official release and looks for malware. See [Scan a site for malware](https://app.nuvlo.dev/docs/security-scans).

**AI bots on this site** shows requests from AI crawlers and assistants, and lets you set what each group of AI bots may do.

---
Source: https://app.nuvlo.dev/docs/wordpress-security