Enhance security for WordPress (Cursor Agent)

.htaccess

# BEGIN Security
<IfModule mod_headers.c>
	Header set X-Content-Type-Options "nosniff"
	Header set X-Frame-Options "SAMEORIGIN"
	Header set Referrer-Policy "strict-origin-when-cross-origin"
	Header set Permissions-Policy "camera=(), microphone=(), geolocation=()"
	Header unset X-Pingback
</IfModule>

<FilesMatch "(?i)^(xmlrpc\.php|readme\.html|license\.txt|wp-config-sample\.php)$">
	Require all denied
</FilesMatch>

<IfModule mod_rewrite.c>
	RewriteEngine On
	RewriteRule ^wp-content/uploads/.*\.(php[0-9]?|phtml|phar|cgi|pl|py|sh)$ - [F,L,NC]
</IfModule>
# END Security

wp-config.php

<?php

define( 'WP_DEBUG_DISPLAY', false );
define( 'WP_DEBUG_LOG', false );
define( 'DISALLOW_FILE_EDIT', true );

define( 'WP_DEVELOPMENT_MODE', '' );

wp-content\mu-plugins\security-hardening.php

<?php
/**
 * Plugin Name: Security Hardening
 * Description: Disables XML-RPC, hides the WordPress version, and stops anonymous username discovery.
 */

add_filter( 'xmlrpc_enabled', '__return_false' );
add_filter( 'xmlrpc_methods', '__return_empty_array' );
add_filter( 'pings_open', '__return_false' );
add_filter( 'the_generator', '__return_empty_string' );

add_action(
	'init',
	static function () {
		if ( isset( $_SERVER['SCRIPT_NAME'] ) && 'xmlrpc.php' === basename( wp_unslash( $_SERVER['SCRIPT_NAME'] ) ) ) {
			status_header( 403 );
			exit;
		}
	}
);

add_filter(
	'wp_headers',
	static function ( $headers ) {
		unset( $headers['X-Pingback'] );
		return $headers;
	}
);

remove_action( 'wp_head', 'wp_generator' );
remove_action( 'wp_head', 'rsd_link' );
remove_action( 'wp_head', 'wlwmanifest_link' );

add_action(
	'init',
	static function () {
		if ( is_admin() || ! isset( $_GET['author'] ) ) {
			return;
		}
		wp_safe_redirect( home_url( '/' ), 301 );
		exit;
	}
);

add_action(
	'template_redirect',
	static function () {
		if ( is_author() ) {
			wp_safe_redirect( home_url( '/' ), 301 );
			exit;
		}
	}
);

add_filter(
	'rest_pre_dispatch',
	static function ( $result, $server, $request ) {
		if ( null !== $result || is_user_logged_in() ) {
			return $result;
		}
		$route = $request->get_route();
		if ( 0 === strpos( $route, '/wp/v2/users' ) ) {
			return new WP_Error(
				'rest_forbidden',
				__( 'Sorry, you are not allowed to do that.' ),
				array( 'status' => 401 )
			);
		}
		return $result;
	},
	10,
	3
);

add_filter(
	'login_errors',
	static function () {
		return __( 'Login failed. Please check your details and try again.' );
	}
);

wp-content\uploads\.htaccess

# Block scripts dropped into the media library.
<FilesMatch "(?i)\.(php[0-9]?|phtml|phar|cgi|pl|py|sh)$">
	Require all denied
</FilesMatch>