Why Hardening Works

Attacks against WordPress aren't exotic, and that's good news. Year after year, the overwhelming majority of compromised sites fall to the same few causes: vulnerable or abandoned plugins, stolen or brute-forced credentials, and unpatched software. Attackers run automated scanners against millions of sites — they aren't targeting you personally, they're targeting anything that answers with a known weakness.

That means a systematic hardening pass removes you from almost every attack that will ever reach your site. The numbers back this up: Sucuri found that over 90% of infected sites were running outdated software, and Wordfence reports that brute-force login attacks make up roughly 40% of attempted breaches. Both are almost entirely preventable.

Here's the checklist, ordered by impact. You can work through it in an afternoon.

The Critical Layer (Do These First)

• Update everything, automatically where possible. WordPress core, every plugin, every theme. Enable automatic core updates. Delete anything you're not using — inactive plugins are still exploitable. This one step addresses the single most common cause of compromise.
• Enforce strong authentication. A strong, unique password on every account, plus two-factor authentication on all admin accounts. Even if a password leaks in a data breach elsewhere, 2FA keeps the attacker out.
• Limit login attempts. Lock out bots after a few failed tries. Combined with 2FA, this makes credential attacks effectively useless.
• Run daily offsite backups. Keep at least 30 days of history. A tested, restorable backup turns any future incident into a single restore instead of a crisis.
• Enforce SSL. Baseline in 2026 — encrypt all traffic to and from the site.

The Hardening Layer

• Lock down wp-config.php. Set its permissions to 600, and move it or protect it so it's not web-accessible. It holds your database credentials and security keys.
• Disable file editing from the dashboard. Add define('DISALLOW_FILE_EDIT', true); so a compromised admin account can't inject code through the built-in editor.
• Set correct file permissions. Directories to 755, files to 644, wp-config.php to 600. Wrong permissions are an instant risk.
• Apply least-privilege user roles. Give each person the minimum role they need — most contributors need Author, not Administrator. If an Editor account is compromised, it shouldn't be able to install plugins.
• Disable XML-RPC unless you specifically need it (Jetpack, some mobile apps). Attackers use it to multiply brute-force attempts.

The Monitoring Layer

• Add a firewall (WAF). A web application firewall blocks malicious traffic before it reaches your site.
• Enable file integrity monitoring. Tools like Wordfence and Sucuri alert you the moment core files change, so you catch an infection within hours instead of discovering it weeks later when Google flags you.
• Run a modern, supported PHP version. Old PHP versions have known, unpatched vulnerabilities.

Keep It Hardened

Security isn't a one-time setup — it's a habit. New plugin vulnerabilities are disclosed every week, so a site that was secure three months ago may have an unpatched hole today. A practical rhythm:

• Weekly: apply updates (or automate core updates).
• Monthly: confirm backups are running and restorable.
• Quarterly: audit user accounts, remove anyone who no longer needs access.
• Continuously: file integrity monitoring, alerting you immediately to changes.

When You'd Rather Not Do It Yourself

This checklist is designed to be doable in an afternoon if you're comfortable in the WordPress dashboard, the file system, and PHP configuration. But many of these steps — SSL provisioning, automatic updates, file permission enforcement, server-level firewalls, daily backups, and continuous monitoring — are exactly the kind of ongoing work that's easy to set up once and then forget to maintain.

That's what an ongoing maintenance plan is for. At WPSecureGuard, with 25+ years of WordPress and PHP experience, we handle hardening, updates, monitoring, and backups continuously — so your site stays in the secure 5%, not the 95% running on an unpatched weakness.

If you'd rather have your site hardened and kept that way without doing it yourself, see our protection plans. →