Agency tools
Security settings
The eight switches under Settings → EstatePoint Security, what each one does, and which are on before you touch anything.
EstatePoint Core adds one screen of security switches: Settings → EstatePoint Security. Nothing here replaces a security plugin or your host’s firewall — these are the WordPress-level settings a property site almost always wants, in one place, with the risky ones left off.
What is on before you touch anything
| Setting | Default | What it does |
|---|---|---|
| Disable pingbacks | On | Removes the X-Pingback header and the pingback methods, a common spam and reflection vector. XML-RPC as a whole stays available. |
| Generic login errors | On | One message for every failed login, so the form never reveals whether a username exists. |
| Limit failed login attempts | On | After repeated failures from the same address the login form refuses that address for a while. An account is never locked by its username alone, and a successful login clears the count. |
| Rate-limit public REST endpoints | On | A generous per-visitor limit on the public browse endpoints (favorites, map search, live search). Signed-in editors are exempt, so only abusive anonymous traffic feels it. |
| Turn off application passwords | On | Application passwords sign in without a second step. A fresh site has none, so leaving them off costs nothing until an integration needs one. |
| Disable XML-RPC | Off | Turns the XML-RPC API off entirely. Leave it off if you use Jetpack, the WordPress mobile app, or remote publishing. |
| Block user enumeration | Off | Stops anonymous visitors from discovering account names: the wp/v2/users routes go, ?author=1 lookups answer “not found”, and authors stay out of the sitemap. Author pages linked from your own posts keep working. Leave it off if something reads users anonymously, such as a headless front end. |
| Safe security headers | Off | Sends X-Content-Type-Options, X-Frame-Options and Referrer-Policy on the front end. CSP and HSTS are deliberately not sent from here — set those at the server or host level. |
Turning one on or off
Each row is a checkbox with its own explanation on the screen. Save, then check the part of the site that setting touches — for example, publish from the WordPress app after changing XML-RPC, or load a listing page after turning headers on.
Pinning a setting in wp-config.php
Every switch has a constant that wins over the screen, so an agency can fix a policy for a client site and leave the screen read-only:
define( 'ESTATEPOINT_SECURITY_XMLRPC_DISABLE', true );
define( 'ESTATEPOINT_SECURITY_LOGIN_ATTEMPT_LIMIT', false );The constants follow the setting names: ESTATEPOINT_SECURITY_PINGBACK_DISABLE, ESTATEPOINT_SECURITY_REST_USER_ENUMERATION_BLOCK, ESTATEPOINT_SECURITY_LOGIN_GENERIC_ERRORS, ESTATEPOINT_SECURITY_HEADERS, ESTATEPOINT_SECURITY_REST_THROTTLE, ESTATEPOINT_SECURITY_APPLICATION_PASSWORDS_DISABLE. Developers can override any of them at runtime with the matching estatepoint_core_security_* filter.
Two-factor sign-in
EstatePoint adds no login screen of its own — administrators and consultants sign in through the standard WordPress login. A standard two-factor plugin from the WordPress plugin directory therefore protects every sign-in, including consultants reaching their panel, and the Security screen recommends turning one on. Consultants can switch two-factor on or off for themselves from My profile in the agent dashboard.
Visitors behind a proxy
The failed-login limit, the REST rate limit and the inquiry form limit all need to tell visitors apart. Requests from Cloudflare use the visitor address Cloudflare passes along; anywhere else, forwarded-address headers are ignored, because a visitor can type anything into them. Behind another proxy or load balancer, list its addresses so visitors are not counted as one:
define( 'ESTATEPOINT_TRUSTED_PROXIES', '10.0.0.0/8' );Next
Troubleshooting — what to check when a setting has an effect you did not expect.