Guides
WordPress as a back office
Hardening WordPress for headless use.
On a new install, Leiho also hardens WordPress for headless use (Settings → WordPress as a back office): no indexing of the CMS (noindex header, robots.txt, no sitemap), public WordPress pages redirect to the same page on the front end, XML-RPC off, /wp/v2/users closed to visitors. wp-admin, login, the REST API and draft previews keep working. Sites updating from an earlier version keep their behavior until you tick the options.