Brightery File Lockdown - optional wp-config.php settings

Add only the settings you need above the line that says:
/* That's all, stop editing! Happy publishing. */

// Master switch. Protection is enabled by default.
define( 'BRIGHTERY_FILE_LOCKDOWN', true );

// Updates remain allowed by default.
define( 'BRIGHTERY_FILE_LOCKDOWN_ALLOW_CORE_UPDATES', true );
define( 'BRIGHTERY_FILE_LOCKDOWN_ALLOW_PLUGIN_UPDATES', true );
define( 'BRIGHTERY_FILE_LOCKDOWN_ALLOW_THEME_UPDATES', true );

// PDF is denied by default. Set true only when the site needs PDF uploads.
define( 'BRIGHTERY_FILE_LOCKDOWN_ALLOW_PDF', false );

// Trusted maintenance override. Keep false during normal operation.
define( 'BRIGHTERY_FILE_LOCKDOWN_MAINTENANCE', false );
define( 'BRIGHTERY_FILE_LOCKDOWN_MAINTENANCE_CLI_ONLY', true );

// Additional media MIME types may be explicitly allowlisted.
// Executable/script/archive extensions are still rejected.
// define( 'BRIGHTERY_FILE_LOCKDOWN_EXTRA_MIMES', array( 'heic' => 'image/heic' ) );

Recommended WordPress core hardening setting:
// define( 'DISALLOW_FILE_EDIT', true );
