A WordPress website can be compromised without any obvious warning. The problem may start with an outdated plugin, a reused password, an abandoned administrator account, weak file permissions, or an insecure hosting configuration.

You do not need to apply every security technique you find online to protect a WordPress website. Some measures are simple and highly effective. Others require server access and should only be used when they fit your hosting environment.

This WordPress hardening checklist focuses on the practical measures that make the most sense for a typical WordPress website. It covers WordPress core, plugins, themes, user accounts, authentication, files, hosting, backups, login protection, XML-RPC, database security, monitoring, and recovery.

The goal is straightforward. Reduce unnecessary exposure, limit administrative access, keep your software maintained, and have a reliable recovery plan if something goes wrong.

What Is WordPress Hardening?

WordPress hardening is the process of strengthening a WordPress website by reducing unnecessary security risks.

It involves more than installing a security plugin.

A properly hardened website usually has several layers of protection. WordPress itself is maintained. Plugins and themes come from trusted sources. Administrator accounts use strong authentication. Files have sensible permissions. HTTPS protects connections. Login attempts are controlled. Backups are available and tested.

WordPress describes hardening around three broad ideas: limiting access, containing damage when something goes wrong, and preparing for recovery through backups and knowledge of the system.

That distinction matters.

Security is not a single setting. It is a collection of decisions that reduce the number of ways an attacker can gain access or cause damage.

WordPress Hardening Checklist at a Glance

Before going through the details, use this quick WordPress hardening checklist:

• Keep WordPress core updated
• Update plugins and themes
• Remove unused plugins and themes
• Use strong, unique passwords
• Enable two-factor authentication
• Review administrator accounts
• Apply least privilege to user roles
• Use HTTPS everywhere
• Disable the built-in file editor
• Protect wp-config.php
• Review file permissions
• Secure the hosting account
• Add appropriate WAF and login protection
• Review XML-RPC usage
• Protect the database
• Maintain reliable backups
• Test backup restoration
• Disable public error display
• Monitor important security events
• Review the site regularly

1. Keep WordPress Core Updated

One of the simplest security measures is also one of the easiest to neglect.

WordPress releases security updates when vulnerabilities are identified and fixed. Running an old version leaves your website exposed to problems that may already have publicly documented solutions.

Open your WordPress Dashboard and visit:

Dashboard > Updates

Check the WordPress version, plugins, and themes regularly.

Automatic updates can reduce maintenance work, but you should still understand what is installed on your site. Automatic updating does not replace backups or testing.

For a small blog, keeping WordPress current is usually straightforward. Larger websites should consider staging environments and a controlled update process, particularly when they depend on custom plugins or themes.

Do not download WordPress core from unofficial sources. Use the official WordPress distribution or a trusted hosting process.

2. Update Every Plugin and Theme You Actually Use

Plugins and themes are common components of WordPress websites, which makes them an important part of your security maintenance.

An outdated plugin may contain a vulnerability that an attacker can exploit without knowing your WordPress administrator password.

That does not mean you should stop using plugins. It means you should know exactly what is installed.

Review your plugin list and ask:

Do I still use this plugin?

Is it maintained?

Does it receive security updates?

Is it compatible with my current WordPress version?

Does another plugin already provide the same functionality?

If you cannot justify a plugin’s presence, remove it.

The same principle applies to themes. Keep the theme you use and retain an appropriate fallback theme when needed. Remove themes that have no purpose on the website.

3. Remove Unused Plugins and Themes

Deactivation is not the same as removal.

An inactive plugin remains on your server. If its files contain a vulnerability, the fact that the plugin is inactive does not automatically make the software irrelevant to your security review.

WordPress recommends deleting plugins that you are not using.

This is one of the easiest hardening tasks for a site owner.

Go through your installed plugins and themes. Remove abandoned experiments, duplicate tools, old migration plugins, temporary maintenance plugins, and software that you installed for a test but never used again.

A smaller software footprint also makes your website easier to maintain.

4. Protect Administrator Accounts

Your administrator account has considerable control over the website.

An attacker who obtains administrator credentials may be able to install plugins, modify themes, create users, change settings, or alter website content.

Use a unique password for every important account.

Your WordPress password should not be the same password you use for email, hosting, your domain registrar, or another website.

A password manager can generate and store unique credentials without requiring you to remember each one.

Also review the administrator list.

If a developer, writer, employee, or contractor no longer needs access, remove the account or reduce its permissions.

5. Enable Two-Factor Authentication

A password alone provides limited protection when the password itself is stolen.

Two-factor authentication adds another authentication factor. Depending on the implementation, this can involve an authenticator application, security key, passkey, or another supported method.

Prioritize administrator accounts.

For example, if an attacker obtains an administrator’s password through credential theft, 2FA can prevent the password from being sufficient to complete the login.

WordPress core does not currently provide built-in administrator 2FA. You can implement it through a reputable security plugin or an external identity provider.

For a security-focused WordPress setup, administrator accounts should be treated differently from ordinary subscriber accounts.

6. Avoid Giving Everyone Administrator Access

WordPress provides different user roles because different people need different permissions.

A contributor does not need the same access as an editor.

An editor does not normally need the same access as an administrator.

Use the lowest role that allows a person to perform the required task.

This is the principle of least privilege.

Suppose someone only writes blog posts. Giving that person administrator access creates unnecessary risk. If the account is compromised, the attacker receives all the permissions attached to that account.

Review your users under:

Users > All Users

Pay particular attention to old administrator accounts and accounts created for temporary projects.

7. Use HTTPS Across the Entire Website

HTTPS protects data transmitted between the visitor and your website.

This matters particularly when users submit passwords, forms, payment information, or other sensitive information.

Check that your WordPress Address and Site Address use HTTPS.

Also check for mixed content. A website can appear to use HTTPS while some resources still load through insecure HTTP connections.

Your SSL/TLS certificate should come from a trusted certificate authority and remain valid.

HTTPS should cover the public website and the WordPress administration area.

8. Disable the WordPress Theme and Plugin File Editor

WordPress can provide a built-in editor that allows administrators to modify plugin and theme files directly from the Dashboard.

For a production website, there is usually little reason to leave this feature available.

You can disable it through wp-config.php by adding:

define( ‘DISALLOW_FILE_EDIT’, true );

This removes the Dashboard-based editing interface.

It does not make the website completely secure, and it does not prevent every method of modifying files. It simply removes one unnecessary administrative capability.

Always back up wp-config.php before changing it.

9. Protect wp-config.php

The wp-config.php file contains sensitive configuration information.

It commonly includes database connection details and other important settings.

Treat it differently from ordinary WordPress content.

Do not publish it in a public repository. Do not leave downloadable copies of it inside your website directory. Be careful with backup files that contain configuration information.

File ownership and permissions should also be appropriate for your hosting environment.

If you are using shared hosting and are uncertain about these settings, ask your hosting provider to review the configuration instead of changing server permissions blindly.

10. Review WordPress File Permissions

File permissions determine who can read, write, or execute files.

Poor permissions can give processes or users more access than they require.

WordPress documentation describes 755 for directories and 644 for files as a common permission arrangement, although the correct configuration depends on the server environment.

Do not treat those numbers as a universal rule.

Some hosting environments use different ownership models. WordPress updates, media uploads, and plugin installation also depend on how PHP and the web server interact with the filesystem.

If you have SSH access and understand Linux permissions, review ownership and permissions carefully.

If you use managed or shared hosting, the hosting provider may be better positioned to handle this layer.

11. Secure Your Hosting Account

WordPress hardening starts before a visitor reaches your website.

Your hosting account controls the environment in which WordPress operates. A compromised hosting account can create problems even if your WordPress administrator password remains secure.

Protect your hosting account with:

A unique password

Two-factor authentication where available

Limited account access

Secure SFTP or SSH access

Regular account reviews

Reliable backups

Current server software

A properly configured firewall

Your domain registrar and email accounts deserve the same attention.

An attacker who gains access to your domain, DNS, hosting, or primary email account may be able to affect your website without directly attacking WordPress.

12. Add Login Protection

WordPress login pages can attract automated password guessing.

Attackers can send large numbers of login attempts using automated systems. Distributed attacks can also come from many different IP addresses.

Use several controls rather than relying on one trick.

Useful options include:

Two-factor authentication

Login rate limiting

A WAF

Bot protection

Strong passwords

Security monitoring

Temporary blocking of abusive traffic

A CDN or edge WAF can be particularly useful because it can block some unwanted traffic before it reaches your hosting server.

Avoid relying on outdated advice that recommends changing the login URL as your main security measure. It can reduce some automated noise, but it should not replace authentication and rate limiting controls.

13. Review XML-RPC Before Disabling It

XML-RPC has been part of WordPress for many years.

It supports certain remote publishing and integration functions. Some websites do not need it at all.

The mistake is assuming that every WordPress site should either enable or disable XML-RPC without checking its requirements.

First, determine whether any service connected to your website depends on it.

If you do not need XML-RPC, you can consider disabling or restricting it.

If you need it, protect the endpoint through appropriate rate limiting and firewall controls.

The correct decision depends on how your website operates.

14. Review REST API Exposure

The WordPress REST API allows applications and services to interact with WordPress.

It is a normal part of modern WordPress.

Do not disable the REST API simply because you see it mentioned in a security tutorial.

A plugin, block editor feature, mobile application, headless frontend, or external integration may depend on it.

Instead, identify what your website exposes and restrict sensitive functionality through proper authentication and authorization.

Security hardening should reduce unnecessary exposure without breaking legitimate functionality.

15. Protect Your Database

The WordPress database stores important website information.

It contains posts, pages, settings, user information, and data generated by plugins and themes.

If you operate multiple WordPress installations on the same server, separating databases and database users can improve containment.

Database credentials should remain private.

Do not place them inside publicly accessible files, public code repositories, screenshots, tutorials, or support requests.

If your hosting provider manages the database server, review the security features they provide and understand how database backups are handled.

16. Build a Real Backup Strategy

A backup is not a security prevention mechanism. It is your recovery mechanism.

If a website is compromised, deleted, corrupted, or damaged during a failed update, a usable backup can dramatically simplify recovery.

A complete WordPress backup should account for both:

WordPress files

Database

Media uploads are part of your files. Your posts, pages, settings, and other database-stored information live in the database.

Do not keep every backup on the same server as the website.

If an attacker gains access to the server and deletes the website, locally stored backups may also be affected.

Maintain an independent backup location and keep multiple restore points.

More importantly, test restoration.

A backup that has never been restored is an assumption rather than a verified recovery plan.

17. Do Not Display Detailed PHP Errors to Visitors

Development and production environments should be treated differently.

Detailed PHP errors can reveal information about files, server paths, plugins, themes, and application behavior.

If debugging is required, use controlled logging rather than publicly displaying detailed errors.

After troubleshooting, review your debugging configuration before leaving the website in production.

This is particularly relevant when developers temporarily enable debugging while diagnosing plugin conflicts or PHP problems.

18. Use Trusted Plugins and Themes

Where you obtain WordPress software matters.

Avoid pirated themes and plugins, commonly referred to as nulled software.

You cannot reliably know what has been changed inside a modified package.

Use the official WordPress repository or reputable commercial developers.

Check the plugin’s update history, compatibility information, support activity, and developer reputation before installing it.

A free plugin from a trusted source can be a perfectly reasonable choice. A premium plugin obtained from an unknown download site can create a completely different security situation.

19. Monitor Your Website After Hardening

Hardening does not end when you finish changing settings.

You need to know when something changes.

Review:

Failed login activity

New administrator accounts

Unexpected plugin installations

Plugin and theme changes

Security alerts

Backup failures

Hosting notifications

SSL certificate problems

Unexpected file changes

Search engine security warnings

You do not need to sit inside your WordPress Dashboard all day.

Use appropriate notifications and monitoring tools so that unusual activity reaches you without requiring constant manual inspection.

20. Create a WordPress Hardening Maintenance Routine

WordPress hardening becomes easier when it becomes part of normal maintenance.

A simple routine can work well for a small WordPress site.

Weekly:

Check WordPress updates.

Review important security notifications.

Check whether backups completed successfully.

Monthly:

Review users and administrator accounts.

Remove unnecessary plugins and themes.

Review security logs.

Check hosting notifications.

Every few months:

Test a backup restoration.

Review firewall settings.

Review connected services.

Check administrator permissions.

Review your hosting security controls.

After major changes:

Create a backup.

Test the change.

Check the live website.

Review forms, login, publishing, media uploads, and integrations.

A Practical WordPress Hardening Workflow

If you are starting with an existing WordPress website, do not change twenty security settings at once.

Use a controlled sequence.

Start with a complete backup.

Then update WordPress, plugins, and themes.

Remove software that you no longer need.

Review administrator accounts.

Enable 2FA for privileged users.

Verify HTTPS.

Disable the built-in file editor.

Review wp-config.php and file permissions.

Secure your hosting and domain accounts.

Add a suitable WAF and login protection.

Review XML-RPC and REST API requirements.

Check your database configuration.

Test the backup restoration process.

Finally, monitor the site.

This order matters because it gives you a recovery point before you start making configuration changes.

WordPress Hardening Mistakes to Avoid

Installing Several Security Plugins

More security plugins do not automatically mean more security.

Two plugins may perform overlapping scans, firewall functions, login protection, or blocking. Their rules can also conflict.

Choose tools based on your actual requirements.

Changing Security Settings Without a Backup

A hardening change can break a legitimate feature.

Create a backup before changing configuration files, server rules, firewall settings, or permissions.

Blocking Entire Countries Without a Specific Reason

Country blocking can affect legitimate visitors, search engines, APIs, payment services, or remote workers.

Use targeted controls when the problem can be solved without blocking an entire geographic region.

Treating a Security Plugin as a Complete Security Strategy

A plugin cannot protect a weak hosting account or recover a website when you have no usable backup.

Security exists at several layers.

Copying Old .htaccess Rules

Many WordPress security tutorials contain rules written for older versions or different hosting environments.

Do not copy a large block of server configuration simply because another website recommends it.

Understand what each rule does and whether your server supports it.

WordPress Hardening Checklist for Beginners

If you are new to WordPress hardening, start here:

• Update WordPress
• Update plugins and themes
• Delete unused plugins and themes
• Use a unique administrator password
• Enable 2FA
• Review administrator accounts
• Use HTTPS
• Disable the file editor
• Review wp-config.php
• Check file permissions
• Secure your hosting account
• Add login protection
• Maintain off-site backups
• Test restoration
• Monitor security alerts

These steps provide a solid foundation without requiring advanced server administration.

Does WordPress Hardening Make a Website Completely Secure?

No.

WordPress Hardening reduces risk. It does not create an absolute security guarantee.

New vulnerabilities can be discovered. Third-party plugins can introduce problems. Credentials can be stolen through phishing. Hosting accounts can be compromised. Human mistakes can bypass otherwise sensible controls.

That is why a layered approach works better than depending on one security feature.

Keep the software maintained. Limit access. Protect authentication. Reduce unnecessary services. Secure the hosting environment. Maintain backups. Monitor important changes.

The objective is to make compromise harder and recovery more manageable.

Final WordPress Hardening Checklist

WordPress hardening is most effective when you treat it as ongoing maintenance rather than a one-time configuration task.

Start with the areas that provide the clearest security value: current software, strong authentication, limited privileges, HTTPS, trusted plugins and themes, sensible file permissions, secure hosting, login protection, and reliable backups.

Then move into more advanced controls such as WAF rules, XML-RPC restrictions, server configuration, monitoring, and database isolation when your website actually needs them.

Your WordPress website does not need a complicated security architecture to benefit from hardening. It needs sensible controls that you understand, maintain, and test.

Use this checklist as a recurring security audit. Review it after major changes to your website, hosting environment, plugins, or user access.

A few minutes spent reviewing your security setup can reveal problems that are much easier to fix before they become a serious incident.

FAQs