WordPress Security Hardening: A Practical Checklist
Most hacked WordPress sites fall to outdated plugins and weak logins. This hardening checklist covers the steps that make the biggest difference.
WordPress powers a huge number of sites, which makes it a constant target for automated attacks. Most of those attacks are not clever. They scan for old plugin versions, guess weak passwords or reuse leaked credentials. That is good news: a handful of consistent habits will stop most of them. Here is a checklist you can work through in an afternoon.
Updates, logins and access
Outdated plugins and themes are the most common way in. Apply updates for WordPress core, plugins and themes promptly, and remove anything you no longer use. Consider enabling automatic updates for minor core releases and for plugins you trust, while testing larger changes on a staging copy first. Our guide on updating WordPress safely explains the routine.
Use strong, unique logins and two-factor authentication
Use a password manager and give every account a long, unique password. Add two-factor authentication for administrators and editors. Do not use admin as a username, and make sure the display name on public posts is not the login name.
Limit user access
Give people the lowest role that lets them do their job. A writer needs Author or Contributor, not Administrator. Remove accounts for people who have left. Fewer administrators means fewer accounts to compromise.
Login page, HTTPS and configuration
Limit failed login attempts, and consider adding a challenge or restricting access to /wp-login.php by IP address where practical. A web application firewall, such as the protection available through Cloudflare, can block many bad requests before they reach WordPress. See our security page for how we approach this at the hosting level.
Use HTTPS everywhere
Serve the whole site over HTTPS, including the admin area. Free Let's Encrypt certificates are included with our hosting; see the SSL page. In wp-config.php you can force secure admin sessions:
define( 'FORCE_SSL_ADMIN', true );Disable file editing in the dashboard
WordPress lets administrators edit plugin and theme files from the dashboard. If an attacker gets in, that is a ready-made tool. Turn it off:
define( 'DISALLOW_FILE_EDIT', true );Set correct file permissions
Files should generally be readable by the web server but not world-writable. Avoid setting folders to full permissions to fix an upload problem; find the real ownership issue instead. Keep wp-config.php as locked down as your setup allows, and never leave backups or database dumps inside the web root.
Backups, sources and monitoring
Security is about recovery as much as prevention. Keep automatic backups stored away from the web server, and test restoring them. If something goes wrong, a clean backup is your fastest way back.
Install software only from trusted sources
Use plugins and themes from the official directory or the developer. Pirated premium software is a frequent source of hidden backdoors. If a licence is too expensive, look for a lighter alternative instead.
Watch for changes
Security plugins or monitoring services can alert you to file changes, new administrator accounts and unusual login activity. Alerts only help if someone reads them, so route them to an email address you check.
Reduce what is exposed
- Delete unused themes and plugins, not just deactivate them.
- Disable XML-RPC if you do not use it, or restrict it.
- Hide version numbers where easy, but do not rely on obscurity.
- Use separate database users for separate sites, with strong passwords.
Keep the server layer healthy
Hardening WordPress is only half the job. The server needs a supported PHP version, current operating system updates and isolation between accounts. On shared and managed plans that is handled for you; on a VPS you are responsible for it.
A quick hardening table
| Area | Action | Effort |
|---|---|---|
| Updates | Core, plugins, themes current | Low |
| Accounts | Strong passwords, 2FA, least privilege | Low |
| Config | Disable file editing, force SSL admin | Low |
| Backups | Off-server, tested restores | Medium |
| Firewall | WAF and login limits | Medium |
No site is 100% safe
Be honest about limits. Hardening reduces risk; it does not remove it. Have a plan for what you will do if the site is compromised, and keep the contact details of whoever will help.
Make security a habit, not a project
The biggest weakness in most WordPress security setups is not a missing feature but a missing routine. Put a monthly reminder in your calendar to review users, check for plugins that have stopped receiving updates, read your security alerts and confirm that a recent backup restores. Twenty minutes a month is more valuable than a one-off hardening session that is never revisited.
Also write down who has access to what: hosting panel, domain registrar, WordPress administrator accounts and any third-party services. When an agency or freelancer finishes a project, remove their access the same day.
If you only have time for three things today, make them these: update everything, turn on two-factor authentication for every administrator, and confirm that a recent off-server backup exists. They address the most common ways sites are compromised and the most important way of recovering.
Security at the hosting level
Good hosting supports your own hardening. Our WordPress hosting includes free SSL, Plesk for managing access, and Cloudflare CDN availability, and our support team can answer questions about securing your site in 17 languages.
