Simple must-use plugin to lock down WordPress and keep it up-to-date. Useful for canary sites.

lock-down.php

<?php

/**
 * Place this file in `wp-content/mu-plugins/lock-down.php` and it will be automatically loaded by WordPress.
 */

// Auto-update all the things.
add_filter( 'auto_update_core', '__return_true' );
add_filter( 'auto_update_plugin', '__return_true' );
add_filter( 'auto_update_theme', '__return_true' );

// Disable post/page comments.
add_filter( 'comments_open', '__return_false' );
add_filter( 'option_default_comment_status', function () { return 'closed'; } );

// Discourage search engine indexing.
add_filter( 'option_blog_public', '__return_zero' );

// Enforce the default theme.
add_action( 'init', function () {

	if ( WP_DEFAULT_THEME !== get_option( 'stylesheet' ) && is_dir( trailingslashit( get_theme_root() ) . WP_DEFAULT_THEME ) ) {

		switch_theme( WP_DEFAULT_THEME );

	}

} );

// Disable the core REST API.
add_filter( 'rest_authentication_errors', function ( $auth ) {

	if ( ! is_user_logged_in() ) {

		return new WP_Error(
			'rest_access_restricted',
			'Only authenticated users can access the REST API.',
			[ 'status' => rest_authorization_required_code() ]
		);

	}

	return $auth;

} );