The WordPress security hardening checklist I use on every site

No website is unhackable. The goal of hardening is to make yours a bad target: harder to get into than the thousands of sites next to it, and quick to recover if something does go wrong.

This is the checklist I work through after every malware cleanup and on every new build.

Keep everything updated

Most WordPress hacks don't involve clever attackers. They involve automated bots scanning for plugins with known vulnerabilities. Keeping things updated removes most of that risk.

• Update WordPress core, plugins and themes regularly
• Remove plugins and themes you don't use, including inactive ones; their files can still be exploited
• Replace plugins that haven't been updated in a long time
• Run a PHP version that still receives security updates

Lock down accounts

• Give every person their own account, with the lowest role they need. Editors don't need to be administrators.
• Delete accounts for former staff, agencies and freelancers.
• Use long, unique passwords stored in a password manager.
• Turn on two-factor authentication for every administrator. I've covered the options in login security and 2FA for WordPress.

Protect the login

• Limit failed login attempts, so bots can't guess passwords endlessly
• Disable XML-RPC if nothing on your site needs it; some apps and Jetpack features do, so check first
• Avoid obvious usernames like admin

Harden wp-config.php

A few lines in wp-config.php go a long way:

// Stop anyone editing theme and plugin files from the dashboard
define( 'DISALLOW_FILE_EDIT', true );

// Always use HTTPS for the dashboard
define( 'FORCE_SSL_ADMIN', true );

Also make sure the security keys and salts are set and unique. You can generate a fresh set from the official WordPress secret-key service; changing them signs every user out, which is exactly what you want after a security incident.

Set sensible file permissions

On most hosts, the safe defaults are:

• 755 for folders
• 644 for files
• 440 or 400 for wp-config.php, where your host allows it

Nothing should be 777. If a plugin asks for that, it's a warning sign.

Add a firewall

A web application firewall blocks known attacks before they reach WordPress. It can be a security plugin or a service in front of your site, like a CDN with firewall rules. Either is far better than nothing.

Use HTTPS everywhere

An SSL certificate is free with most hosts. Make sure every page redirects to HTTPS, not just the homepage, and that there are no mixed-content warnings.

Separate your sites

If several websites share one hosting account, an infection on one can spread to all of them. Keep important sites in separate accounts, or at least separate users, and delete old test sites you've forgotten about.

Back up, off-site, and test it

Backups are your last line of defence. A good setup has:

• Automatic daily backups of files and the database
• Copies stored somewhere other than the web server
• Several weeks of history, because infections are often discovered late
• A restore you've actually tested

Monitor

Finally, know when something changes. Uptime monitoring, file-change alerts and regular malware scans mean you hear about a problem from a tool rather than from a customer.

Want this done for you? It's included in every malware cleanup and in my care plans.