WordPress Security Hardening: A Complete Checklist

Most hacked WordPress sites I've cleaned up weren't attacked in a clever way. They had an outdated plugin, a reused password or a forgotten admin account. Here's the checklist I run on every site I take over.

1. Updates and plugin hygiene

• Keep WordPress core, themes and plugins updated. Enable auto-updates for minor core releases.
• Delete plugins and themes you don't use. Deactivated code can still be exploited.
• Avoid nulled or pirated premium plugins. They are a common source of backdoors.

2. Accounts and logins

• No user called admin. Give everyone their own account with the lowest role that works.
• Enable two-factor authentication for every administrator.
• Limit login attempts and add a CAPTCHA to the login form.
• Audit the user list quarterly and remove ex-staff and old agency accounts.

3. Harden wp-config.php

// Disable the built-in file editor
define('DISALLOW_FILE_EDIT', true);

// Force SSL for admin
define('FORCE_SSL_ADMIN', true);

// Use fresh salts: https://api.wordpress.org/secret-key/1.1/salt/
define('AUTH_KEY', '...');

Also change the default wp_ table prefix on new installs, and move wp-config.php one directory above the web root if your host allows it.

4. File permissions

find /var/www/site -type d -exec chmod 755 {} \;
find /var/www/site -type f -exec chmod 644 {} \;
chmod 600 /var/www/site/wp-config.php

5. Block common attack paths

On Nginx:

# No PHP execution inside uploads
location ~* /wp-content/uploads/.*\.php$ { deny all; }

# Block xmlrpc unless you need it (Jetpack, some apps)
location = /xmlrpc.php { deny all; }

# Hide dotfiles
location ~ /\. { deny all; }

On Apache, put this .htaccess in wp-content/uploads:

<Files *.php>
  Require all denied
</Files>

6. Put a firewall in front

A WAF stops a large share of automated attacks before they reach PHP. Cloudflare (even the free plan) with sensible rules, or a plugin-level firewall like Wordfence, are both good options. Rate-limit /wp-login.php at the edge if you can.

7. Backups and monitoring

• Daily off-site backups of the database and wp-content, kept for at least 14 days.
• Uptime monitoring with alerts by email or Slack.
• File integrity or malware scanning, so you know something changed before Google flags the site.

8. If you're already hacked

1. Take a full backup of the infected site for forensics.
2. Reset every password: WordPress users, database, hosting, SFTP.
3. Replace core files with fresh copies and reinstall plugins from official sources.
4. Search for backdoors in uploads, mu-plugins and recently modified files.
5. Request a review in Google Search Console once the site is clean.

Want a security audit or a cleanup? Get in touch.