By RyskenUpdated 1 min read
Hardening means making a WordPress website harder to attack and less damaging when something goes wrong. You do not need to do everything at once: work through this list from the top, test as you go and keep a backup before each change.
Accounts and authentication
- Use strong, unique passwords for every user, stored in a password manager.
- Enable multi-factor authentication for administrators and editors.
- Apply least privilege. Give each user the lowest role that does the job.
- Remove dormant and shared accounts, and avoid the username “admin”.
- Limit login attempts and consider restricting access to the login page.
Updates and components
- Keep WordPress core updated, with automatic security updates enabled where appropriate.
- Update plugins and themes promptly, prioritising security releases.
- Delete unused plugins and themes; deactivated code can still be exploited.
- Vet new plugins for active maintenance, reputation and a legitimate source.
Files and configuration
- Set correct file permissions and protect
wp-config.php. - Disable file editing from the dashboard (
DISALLOW_FILE_EDIT). - Block PHP execution in the uploads directory.
- Remove stray files: backups, old copies, readme and debug logs.
- Turn off debug output on production and disable directory listing.
Server and transport
- Force HTTPS everywhere and renew certificates automatically.
- Add security headers such as HSTS, X-Content-Type-Options and a sensible Content Security Policy.
- Restrict unused endpoints such as XML-RPC if nothing depends on them.
Resilience and visibility
- Keep automated off-site backups and test a restore regularly.
- Log and monitor logins, file changes and unexpected admin activity.
- Review security on a schedule, for example after major changes and at least quarterly.
Need a second pair of eyes?
If you want these controls reviewed or applied safely, our WordPress hardening service reviews your configuration, applies the changes that fit your environment and documents them. Not sure where you stand? Start with a security assessment, or ask us a question.
