Securing a custom WordPress or PHP web application requires proactive perimeter defense: HTTP security headers, sanitizing all inbound GET/POST variables, and deploying web application firewalls (WAF)...