https://blog.wpsec.com/reducing-the-wordpress-attack-surface/