Why WordPress Is a Primary Target

WordPress's enormous market share makes it a high-value target for automated attacks. Bots continuously scan the internet for outdated plugins, weak admin credentials, and exposed configuration files. The good news: most successful attacks exploit preventable misconfigurations, not sophisticated zero-days. A disciplined hardening approach eliminates the vast majority of risk.

Step 1: Keep Everything Updated

Outdated WordPress core, themes, and plugins account for a significant proportion of compromised sites. Enable automatic updates for minor releases and security patches. For major updates, test in a staging environment first.

  • Update WordPress core promptly after security releases.
  • Remove unused plugins and themes — deactivated but installed plugins can still be exploited.
  • Use only plugins from reputable sources with active maintenance histories.

Step 2: Secure the Admin Login

The /wp-admin and /wp-login.php URLs are hammered by credential-stuffing bots constantly. Harden this surface with multiple layers:

  1. Change the default admin username. Never use "admin" — it's the first thing bots try.
  2. Use a strong, unique password. At least 20 characters using a password manager.
  3. Enable two-factor authentication (2FA). Plugins like WP 2FA or Google Authenticator add this easily.
  4. Limit login attempts. Plugins like Limit Login Attempts Reloaded block IP addresses after repeated failures.
  5. Restrict wp-admin access by IP. If you have a static IP, whitelist it via your .htaccess or server firewall.

Step 3: Configure File Permissions Correctly

Incorrect file permissions are a common entry point. Use these recommended settings:

ResourceRecommended Permission
WordPress directories755
WordPress files644
wp-config.php440 or 400
.htaccess444

Step 4: Protect wp-config.php

The wp-config.php file contains your database credentials. Move it one directory above the web root if your host allows it, or block access via .htaccess:

<files wp-config.php>
order allow,deny
deny from all
</files>

Also disable file editing from within the WordPress dashboard by adding define('DISALLOW_FILE_EDIT', true); to wp-config.php.

Step 5: Install a Web Application Firewall (WAF)

A WAF filters malicious traffic before it reaches your application. For WordPress, options include:

  • Wordfence: Popular plugin-based WAF with malware scanning and firewall rules.
  • Sucuri: DNS-level WAF that blocks attacks before they reach your server.
  • Cloudflare WAF: CDN-integrated protection with a free tier for basic coverage.

Step 6: Implement SSL/TLS Correctly

Every WordPress site should run over HTTPS. Use a certificate from Let's Encrypt (free) or your hosting provider. After enabling SSL:

  • Force HTTPS via redirects in .htaccess or your server config.
  • Set the HTTPS and COOKIE_DOMAIN constants in wp-config.php.
  • Enable HTTP Strict Transport Security (HSTS) headers.

Step 7: Regular Backups and Monitoring

Security hardening reduces risk but doesn't eliminate it entirely. Maintain regular, tested backups stored offsite (not just on your hosting server). Use a monitoring service to alert you to file changes, downtime, or suspicious login activity.

Hardening WordPress is an ongoing practice, not a one-time task. Revisit this checklist quarterly and after any major plugin or theme changes.