WordPress runs roughly 40% of the web, which makes it a permanent target. Most attacks are automated and opportunistic. They probe for weak passwords, outdated software, and exposed admin URLs, hoping to find an easy way in. Real hardening reduces the attack surface so most attempts fail without you ever noticing. This post is the practical checklist, based on the official WordPress.org hardening guide and what actually stops real-world attacks.

A WordPress security dashboard showing firewall status, login attempts blocked, and update notifications

Attack surface basics

Most WordPress attacks come through a small number of channels:

  • Brute-force login attempts, guessing at the admin password.
  • Exploits in outdated plugins or themes.
  • Vulnerabilities in WordPress core, which are rare but do happen.
  • Compromised credentials leaked from other, unrelated sites.
  • Server-level issues, which are mostly your host’s job to prevent.

Hardening addresses each of these one at a time.

1. Strong passwords and 2FA

This is the single highest-impact security measure you can take, and it’s the top recommendation in CISA’s own guidance on password managers.

  • Use a unique, long password of 20 or more characters.
  • Use a password manager like 1Password, Bitwarden, or LastPass.
  • Never reuse passwords across different sites.
  • Enable two-factor authentication (2FA) for every admin account.

Plugins that include 2FA: Wordfence, WP 2FA, and Two Factor Authentication.

An authenticator app like Authy or Google Authenticator is a stronger choice than SMS-based codes, which can be intercepted more easily.

2. Username hygiene

Don’t use “admin” as your username. It’s the first thing most automated attacks try.

If your site currently uses “admin”:

  1. Create a new admin user with a different username.
  2. Log in as the new user.
  3. Delete the old “admin” account, reattributing its content to the new user first.

3. Limit login attempts

Block IP addresses after a set number of failed login attempts.

Plugins that handle this:

  • Limit Login Attempts Reloaded (free, popular).
  • Wordfence (includes this feature).
  • iThemes Security, now called Solid Security (includes this feature too).

A typical setup locks out an IP after 5 failed attempts, with a 20-minute lockout that lengthens for repeat offenders.

4. Keep everything updated

Most exploits target known vulnerabilities in outdated software, which is exactly why staying current matters so much.

  • WordPress core: enable auto-updates for minor releases.
  • Themes: update within a week of a new release.
  • Plugins: update promptly, ideally within a few days.
  • PHP: keep it on a currently supported version. WordPress.org now recommends PHP 8.2 or higher, with PHP 8.3 or 8.4 preferred for the best performance and longest support window.

Configure auto-updates under Dashboard, then Updates, then Enable. Plugins like Easy Updates Manager give you more granular control if you want it.

5. Remove unused plugins and themes

Inactive plugins and themes can still carry exploitable vulnerabilities even while deactivated.

  • Deactivating isn’t enough. Delete unused plugins entirely.
  • Keep one backup theme installed, ideally a default WordPress theme.
  • Periodically audit your plugin list and ask when you last actually used each one.

6. Use SSL (HTTPS)

  • Free Let’s Encrypt SSL is available through most hosts already.
  • Force HTTPS across the entire site.
  • Watch for mixed content, and make sure all resources like images and scripts load via HTTPS too.

The plugin Really Simple SSL handles redirects and mixed content fixes automatically if you need help.

Without HTTPS, browsers warn visitors, Google ranks the site lower, and login credentials transmit unencrypted, which is a real risk, not a theoretical one.

7. Disable file editing in the dashboard

WordPress lets admins edit theme and plugin files directly from the dashboard by default. Attackers who gain admin access love this feature.

Add this line to wp-config.php:

define('DISALLOW_FILE_EDIT', true);

Real edits happen via FTP or SSH anyway, so disabling this in the dashboard blocks a major attack vector at no real cost to you.

8. Change the login URL (security through obscurity)

The default WordPress login lives at yourdomain.com/wp-admin or wp-login.php, which every bot on the internet already knows.

Changing it to something custom, like yourdomain.com/secret-login, is easy with a free plugin like WPS Hide Login.

This isn’t a real security measure on its own. A determined attacker will still find it. But it cuts noise from automated bots by roughly 90%, which reduces server load and log clutter considerably.

9. Disable XML-RPC if you don’t use it

XML-RPC is an older WordPress API used by some clients, including certain mobile WordPress apps and Jetpack.

If you don’t use those tools, disable XML-RPC. It’s a common attack target precisely because so many sites leave it on without needing it.

Most security plugins offer a simple toggle for this.

10. Install a security plugin

Wordfence

  • The most popular free option, with millions of active installs.
  • Includes a firewall, malware scanning, login security, and 2FA.
  • The free tier is solid on its own. The paid tier, around $119/year, adds real-time firewall rule updates.

Sucuri

  • A free WordPress plugin paired with a paid cloud WAF service.
  • Strong malware cleanup tools if you’re already compromised.
  • The cloud WAF plans start around $229/year.

iThemes Security / Solid Security

  • A comprehensive feature set covering most hardening steps in one plugin.
  • Both free and Pro tiers available.

WP Cerber

  • Free and Pro versions.
  • Particularly strong anti-spam and login security features.

Pick one and stick with it. Don’t run multiple security plugins at the same time. They tend to conflict with each other in ways that cause more problems than they solve.

A security plugin showing firewall log of blocked attacks, geographic distribution of attackers, and recent updates

11. Web Application Firewall (WAF)

A WAF sits between attackers and your site, blocking known attack patterns before they ever reach WordPress itself.

Options worth considering:

  • Cloudflare: the free tier provides basic WAF rules at no cost.
  • Sucuri: a dedicated WordPress WAF, starting around $229/year.
  • Wordfence Premium: includes WAF functionality as part of the paid tier.

Cloudflare’s free tier is usually more than enough protection for small blogs.

12. Backups

Hardening prevents most attacks. Backups are your safety net for the ones that get through anyway.

  • Daily backups for active sites.
  • Weekly at an absolute minimum.
  • Off-site storage, so you’re not relying on your host alone.
  • Test the restore occasionally. Untested backups aren’t really backups.

Plugins like UpdraftPlus, BackWPup, and Duplicator all handle this well, or you can rely on host-level backups from providers like WP Engine and Kinsta. For the full picture on backup strategy, see our guide to WordPress backups and disaster recovery.

13. Hide the WordPress version

By default, WordPress outputs its version number in HTML meta tags. Attackers can use this to target known vulnerabilities in that specific version.

Hide it via a security plugin, or add this to your theme’s functions.php:

remove_action('wp_head', 'wp_generator');

This is a minor measure on its own. Combined with prompt updates, it’s low value but free, so there’s little reason not to do it.

14. Disable directory browsing

If someone navigates directly to /wp-content/uploads/ on your site, they shouldn’t see a directory listing of every file in it.

Most hosts have this disabled by default, but it’s worth verifying by visiting that URL yourself.

If it’s exposed, add this to .htaccess: Options -Indexes

15. Strong user permissions

  • Limit who holds the Administrator role. Most contributors only need Author or Editor access.
  • Review your user list quarterly and remove inactive users.
  • Don’t share admin credentials between people. Create separate accounts for each person instead.

16. Secure wp-config.php

The wp-config.php file contains your database credentials, so it deserves extra protection:

  • Move it above the WordPress root if your host allows this.
  • Set file permissions to 600 or 640.
  • Add this block to .htaccess:
<Files wp-config.php>
order allow,deny
deny from all
</Files>

17. Database table prefix

The default table prefix, wp_, is assumed by some automated attack scripts.

Change it to something custom, like xkj_, at install time. Existing sites can change it through a plugin, and iThemes Security includes this feature.

This is a minor measure, but worth doing on fresh installs since it costs nothing extra at setup time.

18. Hosting matters

Cheap shared hosting often has weaker security at the server level than you’d expect.

Managed WordPress hosts like WP Engine, Kinsta, and Flywheel include server-level firewalls, daily backups, malware scanning, and faster security updates as part of the package. Our comparison of managed versus shared hosting covers when that upgrade is actually worth the cost.

It’s worth the upgrade as your site grows and the stakes of downtime or a breach get higher. None of this depends on which theme you run, but a theme built with clean, minimal code, like Aurora, gives attackers less surface area to poke at in the first place, since there’s simply less custom code doing unpredictable things.

19. SSH/SFTP, not FTP

FTP transmits passwords unencrypted, which means anyone intercepting that traffic can read your credentials directly.

Use SFTP or SSH instead. Most modern hosts offer SFTP by default.

20. Monitor for suspicious activity

Set up ongoing monitoring so you notice problems early:

  • Security plugin notifications for failed logins and file changes.
  • Uptime monitoring, such as the free tier of Uptime Robot.
  • Google Search Console notifications for flagged security issues.
  • A periodic manual review of the site itself.

What to do if compromised

  1. Don’t panic. Working through the steps methodically matters more than speed.
  2. Change all passwords: admin, FTP, database, and hosting account.
  3. Scan with a security plugin like Wordfence or Sucuri.
  4. If malware is found, clean it or restore from a clean backup taken before the compromise.
  5. Consider a professional cleanup service. Sucuri offers a paid option for this.
  6. Investigate the cause: an outdated plugin, a weak password, or a compromised user account.
  7. Submit a “Request review” through Google Search Console if Google flagged the site.

What’s security theater

Some measures feel secure without adding much real protection:

  • Hiding the WordPress version, useful only if you’re also updating promptly.
  • Changing the database prefix on an existing site, which offers minor benefit at best.
  • Renaming wp-admin to something like “wp-admin-2026,” which most attackers simply don’t care about.
  • “Security through obscurity” on its own, without real security measures underneath it.

None of these are harmful. They’re just lower priority than the real basics covered above.

What it comes down to

WordPress security comes down to seven fundamentals: a strong unique admin password, 2FA, limited login attempts, prompt updates, SSL, a security plugin like Wordfence or Sucuri, and working backups. Do those seven well and you’ve blocked roughly 95% of real-world attacks. The advanced measures, like a WAF, file editing restrictions, and custom login URLs, help further but yield diminishing returns after that point. Most “compromised WordPress site” stories trace back to basic gaps: a weak admin password, an outdated plugin, or no 2FA. Cover the basics first, and don’t get distracted chasing exotic theater instead.