Basic WordPress hardening

[gregrickaby]

Closes N/A

DESCRIPTION

One of our clients was recently put through a security audit and I had to make some updates in order to make them compliant. I'm simply bringing these updates back to wd_s.

• Remove generator meta tags
• Disable XML RPC
• Change default REST-API headers from null to *

Note: this PR is not an exhaustive list of ways to secure WordPress, but rather a starting point... so we can provide our future clients peace of mind.

SCREENSHOTS

STEPS TO VERIFY

1. gh pr checkout 709
2. View the front-end and look for generator tags
3. Inspect any REST-API endpoint and verify the Access-Control-Allow-Origin is set to *