WordPress Hardening: The Changes Worth Making, In Order

Search for hardening advice and you get a list of forty changes presented as equally important. They are not. Some remove entire categories of attack. Others are close to decorative.

This WordPress hardening list is ordered by how much risk each item actually removes. If you only do the first four, you have done most of the work.

Tier 1: Do these first

1. Update promptly

The highest-value security work available, and it is not really a hardening measure at all — it is maintenance.

Most compromises exploit a known vulnerability that was patched weeks or months earlier. The gap between a patch being published and applied is where nearly all of the risk lives.

Security releases within 24 to 48 hours. Everything else on a weekly and monthly rhythm, tested on staging.

2. Two-factor authentication on every admin

This makes a stolen or guessed password insufficient by itself. It defeats brute force, credential stuffing and password spraying at once.

Every administrator, editor and shop manager — not just your own account. One unprotected admin undoes the rest.

3. Delete what you are not using

Deactivating a plugin does not remove its code from the server, and in many cases those files can still be executed directly. An abandoned plugin from three years ago will never be patched again.

If it is not in use, delete it. This is free, takes ten minutes, and closes real attack surface.

4. Unique generated passwords

Long, random, unique per service, kept in a password manager. The critical property is that the password is not reused anywhere else — reuse is what makes credential stuffing work.

Tier 2: Clearly worth doing

5. A firewall in front of WordPress

Filters malicious requests before WordPress processes them. It blocks exploit attempts against known vulnerabilities, which partly covers you during the window before you have patched.

6. Least-privilege user roles

Most people with dashboard access do not need administrator rights. Someone writing blog posts needs Author. Every admin account is a full compromise if taken.

Audit the user list quarterly. Old developers and former staff accumulate quietly.

7. Disable file editing in the dashboard

Add to wp-config.php:

define('DISALLOW_FILE_EDIT', true);

This stops anyone who gains admin access from editing theme and plugin code directly through the browser — a favourite route for installing a backdoor. It also stops you breaking the site with a typo.

8. Block PHP execution in uploads

The uploads folder should contain media, never executable code. Blocking PHP execution there neutralises a large share of file-upload attacks. In wp-content/uploads/.htaccess:

<Files *.php>
deny from all
</Files>

9. File integrity monitoring

Not prevention but detection, and detection time is what determines the cost of an incident. Knowing within hours that a file changed unexpectedly is the difference between a small problem and a blacklisting.

10. Off-server backups you have tested

Your recovery path. Test a restore quarterly — an untested backup is a hope. See our backup strategy guide for the detail.

Tier 3: Small but cheap

• Rate limit login attempts — mostly redundant once two-factor is on, but it reduces server load from constant probing
• Disable XML-RPC if nothing uses it — an old amplification vector for brute force
• Hide the WordPress version — trivial obscurity, costs nothing
• Set sensible session lengths so a stolen session does not last weeks
• Security headers — a content security policy is genuinely valuable on checkout pages
• Correct file permissions — 755 for folders, 644 for files, never 777

What you can safely skip

Some popular advice is close to pointless, and chasing it distracts from the items above.

Changing the database table prefix. Frequently recommended, minimal benefit against modern attacks, and a real chance of breaking the site if done badly on a live install.

Renaming the login URL. Reduces automated noise, which helps server load. It is not a security control — it protects nothing if the password is weak.

Hiding the admin username. Sensible not to use admin, but WordPress leaks usernames in several places anyway. Treat it as a small obstacle, not a defence.

Stacking multiple security plugins. They conflict, slow the site, and create gaps where each assumes the other is handling something. One well-configured plugin beats three fighting each other.

The honest framing

Hardening reduces the chance of a compromise and limits the damage when one happens. It does not make a site unbreakable, and any provider claiming otherwise is selling something.

A hardened site that nobody is watching still gets found eventually. A monitored site gets caught in hours instead of weeks. You want both, and monitoring is the one people skip.

This is also why hardening a site that is already compromised achieves little. Clean first, then harden, then monitor — in that order.

A realistic weekend of work

1. Update everything and set up a proper update rhythm
2. Turn on two-factor for every privileged account
3. Delete unused plugins and themes
4. Move all passwords into a manager, generated and unique
5. Audit who has admin access and demote or remove
6. Add DISALLOW_FILE_EDIT and block PHP in uploads
7. Set up a firewall and file integrity monitoring
8. Confirm backups run off-server, and test a restore

That is genuinely most of it. The rest is upkeep.

If you would rather it was handled

Our security monitoring service covers the hardening, the firewall, prompt patching and file integrity alerts — with a person reading them rather than a dashboard nobody opens.

If you suspect the site may already be compromised, harden later. Our security and error fixing service cleans it properly first, backdoors included.

Send us your web address and we will tell you where the actual gaps are.