Over 90,000 WordPress sites are hacked every day. Most attacks exploit basic, preventable vulnerabilities. These 12 hardening steps will close the most common attack vectors and dramatically reduce your risk — no developer experience needed for most of them.
Outdated plugins and themes are the number one entry point for hackers. Enable automatic updates for WordPress core minor releases, and check for plugin and theme updates at least weekly. Deprecated plugins with no recent updates should be replaced. See our full guide on updating WordPress safely.
Use a password manager (Bitwarden is free and excellent) to generate and store 20+ character random passwords for every WordPress admin account, FTP account, cPanel login, and database user. Never reuse passwords across accounts.
Install the free WP 2FA or Wordfence plugin and enable two-factor authentication for all administrator accounts. Even if an attacker gets your password, 2FA stops them from logging in.
Wordfence Security (free) gives you a web application firewall, real-time malware scanner, and login brute-force protection. Configure it to block logins after failed attempts and to send email alerts for critical issues.
If your admin account username is "admin," attackers already know half your login credentials. Create a new admin user with a different username, log in with it, and delete the old "admin" account (reassigning its content to the new account).
Brute-force attacks try thousands of password combinations. Use Wordfence or the Limit Login Attempts Reloaded plugin to block IP addresses after a set number of failed login attempts (3–5 attempts is a reasonable limit).
XML-RPC is a remote access protocol that's frequently abused for brute-force and DDoS attacks. Unless you specifically need it (for Jetpack or mobile app publishing), disable it by adding this to your .htaccess:
Every site should be running on HTTPS. Most hosting providers offer free SSL certificates via Let's Encrypt. Once installed, force HTTPS by adding a redirect in .htaccess or by using the Really Simple SSL plugin.
Incorrect file permissions are a significant security risk. Directories should be set to 755, files to 644, and wp-config.php to 400 or 440. Your hosting provider or a tool like WPFixMate cPanel can set these correctly for your entire installation.
Add the following to the top of your .htaccess to block direct access to sensitive files:
A current clean backup is your ultimate safety net. Without one, a hack can mean total data loss. Use UpdraftPlus (free) to schedule automatic daily or weekly backups to off-site storage (Google Drive, Dropbox, or Amazon S3). See our full guide on WordPress backup frequency.
Exposing your WordPress version helps attackers target known vulnerabilities. Add this to your theme's functions.php to remove it from page source and feeds:
How long does WordPress security hardening take?
Most of the steps above can be completed in 1–2 hours. Installing Wordfence, enabling 2FA, and updating passwords takes under 30 minutes. The technical steps like file permissions and .htaccess rules take a bit longer but are one-time tasks.
Do I need a security plugin if I follow all these steps?
Yes. A security plugin like Wordfence provides real-time firewall protection and malware scanning that can't be replicated manually. Think of the other steps as hardening the locks — the security plugin is the alarm system.
My site was already hacked. Do these steps help?
These steps prevent future attacks but won't clean an existing infection. First, clean the malware (restore from a clean backup or hire a professional), then apply these hardening measures so it doesn't happen again.
I'll implement all 12 of these steps, run a full security scan, and give you a written report of everything done.
Harden My Site — from $79