Hardening WordPress in an afternoon

Most WordPress compromises we clean up weren’t sophisticated. They came through an outdated plugin, a reused password, or a file that anyone could write to. The list below closes those doors. None of it needs a security plugin, and most of it takes minutes.

Before you start

Take a full backup of the files and the database, and store it somewhere other than the server. If you can, restore it to a staging copy first, so you know it works.

1. Update everything

Core, themes, plugins, and the PHP version the site runs on. The majority of real-world attacks use vulnerabilities that already have a patch; the site just hasn’t installed it.

2. Delete what you don’t use

A deactivated plugin still sits on disk, and its files can still be requested directly. If it isn’t active, delete it. Keep one default theme as a fallback and remove the rest.

3. Lock down accounts

• Give every person their own login. No shared admin accounts.
• Use the lowest role that does the job. Most people who publish need Editor, not Administrator.
• Turn on two-factor authentication for every account that can publish or install.
• If there’s still a user called admin, replace it.

4. Stop editing code from the dashboard

Add this line to wp-config.php:

define( 'DISALLOW_FILE_EDIT', true );

It removes the built-in theme and plugin editors, so a stolen login can’t be used to paste code straight into your theme.

5. Tighten file permissions

Directories should be 755 and files 644. Set wp-config.php to 440 or 400 if your host allows it. Nothing on a live site should be 777.

6. Rate-limit the login page

Limit requests to wp-login.php at the server or firewall. If nothing on the site uses XML-RPC (the Jetpack app and some remote publishing tools do), block xmlrpc.php entirely.

7. Send security headers

Start with Strict-Transport-Security, X-Content-Type-Options: nosniff and a Referrer-Policy. Add a Content-Security-Policy once you know every script the site loads, because a strict one will break anything you missed.

8. Put a firewall in front

A web application firewall at the edge, such as Cloudflare or your host’s own, filters known-bad traffic before it ever reaches PHP.

9. Back up off-site, automatically

Daily at minimum, more often for shops. Keep several versions, store them away from the server, and test a restore now and then. A backup that has never been restored is a hope, not a backup.

10. Watch for changes

File-integrity monitoring and uptime checks tell you when something changes that shouldn’t have. It’s the difference between hearing about a hack from an alert and hearing about it from a customer.

If you’d rather hand the whole list over, that’s exactly what our security hardening work covers.