WordPress powers a large part of the web, which also makes it a common target for bots, malware, brute-force attacks, vulnerable plugin scans, and automated exploit attempts.

The good news is that most WordPress security issues can be reduced with a practical layered setup: reliable hosting, regular updates, strong login protection, safe file permissions, hardening rules, firewall protection, malware scanning, vulnerability monitoring, and activity logs.

This guide covers the most important steps to secure a WordPress website. Some steps can be done manually through server configuration, while others are easier to manage with a WordPress security plugin such as SiteFort.

1. Choose Secure WordPress Hosting

Your hosting provider is the foundation of your website security. Even the best WordPress hardening setup cannot fully protect a site hosted on an outdated, poorly isolated, or overloaded server.

A good WordPress host should provide:

  • Supported PHP versions
  • Server-level firewall protection
  • Malware and abuse monitoring
  • Reliable backups
  • SSL support
  • Account isolation on shared hosting
  • Fast security patching
  • DDoS or edge protection options

Managed WordPress hosting can be a good option for business websites because it often includes automatic backups, platform-level security controls, performance tuning, and expert support.

For high-risk or business-critical websites, avoid very cheap shared hosting where sites from different customers are poorly isolated. If another account on the same server is compromised, weak isolation can increase risk for nearby websites.

2. Keep WordPress, Plugins, and Themes Updated

Outdated plugins and themes are one of the most common entry points for WordPress attacks.

Security updates often fix vulnerabilities that attackers can scan for automatically. Once a vulnerability becomes public, bots may begin looking for affected websites very quickly.

Keep these updated:

  • WordPress core
  • Active plugins
  • Active theme
  • Inactive themes you still keep installed
  • PHP version
  • Server software where possible

Remove plugins and themes you do not use. Deactivated plugins can still contain vulnerable files on the server, so they should not be kept unless there is a clear reason.

SiteFort helps with vulnerability monitoring by checking installed WordPress core, plugins, and themes against known vulnerability data, so you can identify risky software before attackers exploit it.

3. Use Strong Login Security

The WordPress login page is one of the most targeted areas of any WordPress site. Bots constantly try weak passwords, leaked credentials, common usernames, and brute-force login attempts.

To protect your login area, use:

  • Strong passwords for all users
  • Two-factor authentication for administrators
  • Login attempt limits
  • CAPTCHA or bot checks
  • Weak and breached password checks
  • Role-based login security rules
  • Safer login error messages

Changing the login URL can reduce automated noise, but it should not be treated as the main login security method. A custom login URL is useful as one extra layer, not a replacement for strong passwords, 2FA, rate limiting, and brute-force protection.

SiteFort includes login protection features such as 2FA, CAPTCHA, brute-force protection, safer login responses, custom login URL support, and weak or breached password checks.

4. Use Correct File Permissions and Ownership

Incorrect file permissions can allow attackers to modify files, upload malware, or spread an infection across the site.

As a general baseline:

  • Files should usually be set to 644
  • Directories should usually be set to 755
  • wp-config.php can often be restricted further, such as 600 or 640, depending on the hosting environment

Example Linux commands:


# Fix directory permissions
find public_html -type d -print0 | xargs -0 chmod 0755

# Fix file permissions
find public_html -type f -print0 | xargs -0 chmod 0644

Be careful before running permission commands on production websites. Some hosts use different ownership models, and incorrect ownership can break updates, uploads, or plugin functionality.

5. Protect Sensitive WordPress Files

Some files should not be publicly accessible from the browser. These may reveal sensitive information, version details, configuration data, or development history.

Important files and folders to protect include:

  • wp-config.php
  • .htaccess
  • readme.html
  • readme.txt
  • .git
  • .svn
  • Backup files
  • Log files
  • Configuration files

For Apache, you can block access to sensitive files with rules like this:


# Protect sensitive files
<FilesMatch "^(wp-config\.php|readme\.html|readme\.txt|\.htaccess)$">
    Require all denied
</FilesMatch>

# Block hidden version control directories
RedirectMatch 403 /\.(git|svn)

For Nginx, similar protection can be added at the server configuration level:


location ~* /(wp-config\.php|readme\.html|readme\.txt|\.htaccess)$ {
    deny all;
}

location ~ /\.(git|svn) {
    deny all;
}

SiteFort includes hardening controls for sensitive file exposure, helping you reduce these risks without manually editing server rules in many cases.

6. Disable File Editing in the WordPress Dashboard

By default, WordPress can allow administrators to edit theme and plugin files from the dashboard. If an attacker gains admin access, this feature can make it easier to inject malware or backdoors.

You can disable dashboard file editing by adding this line to wp-config.php:


define('DISALLOW_FILE_EDIT', true);

This does not prevent developers from editing files through SFTP, Git, or deployment tools. It only disables the built-in theme and plugin editor inside WordPress admin.

SiteFort can apply this type of hardening from the WordPress dashboard with a toggle-based setup.

7. Block PHP Execution in Upload Directories

The WordPress uploads directory should normally contain media files such as images, PDFs, videos, and documents. It should not execute PHP files.

Many malware infections place web shells or backdoors inside wp-content/uploads because the directory is writable. Blocking PHP execution there is one of the most useful WordPress hardening steps.

For Apache, add an .htaccess file inside the uploads directory:


# Disable PHP execution in uploads
<FilesMatch "\.(php|phtml|phar|php[0-9])$">
    Require all denied
</FilesMatch>

For Nginx, this should be handled in the server configuration:


location ~* ^/wp-content/uploads/.*\.(php|phtml|phar|php[0-9])$ {
    deny all;
}

SiteFort includes hardening options to help block PHP execution in risky directories and reduce the impact of uploaded backdoors.

8. Disable Directory Browsing

Directory browsing can expose file lists to visitors when no index file is present. This can reveal plugin names, upload paths, backup files, logs, or other information useful to attackers.

For Apache, add this to your .htaccess file:


Options -Indexes

For Nginx, use:


autoindex off;

This is a simple hardening step, but it helps reduce unnecessary information exposure.

9. Disable or Restrict XML-RPC

xmlrpc.php is a legacy WordPress endpoint used by some mobile apps, Jetpack features, and third-party integrations.

If your website does not use XML-RPC, disabling it can reduce brute-force attempts, pingback abuse, and automated request noise. If your site does need XML-RPC, restrict it carefully and apply rate limiting instead of leaving it fully open.

For Apache:


# Block WordPress XML-RPC requests
<Files xmlrpc.php>
    Require all denied
</Files>

For older Apache 2.2 environments:


<Files xmlrpc.php>
    order deny,allow
    deny from all
</Files>

For Nginx:


location = /xmlrpc.php {
    deny all;
}

You can also disable or restrict XML-RPC using SiteFort hardening and firewall controls, which is safer for site owners who do not want to manually edit server configuration files.

10. Secure the REST API Carefully

Older WordPress hardening guides often recommended disabling the REST API completely. That is no longer a good default recommendation for most websites.

The REST API is used by the WordPress block editor, admin screens, plugins, themes, forms, WooCommerce, headless setups, mobile apps, and integrations. Fully disabling it can break normal functionality.

A better approach is to secure REST API access based on your site’s needs.

Recommended REST API protections include:

  • Do not expose sensitive custom endpoints publicly
  • Require authentication for private or write-capable endpoints
  • Reduce user enumeration where possible
  • Rate-limit repeated API requests
  • Monitor suspicious REST API activity
  • Only allow unauthenticated API access where it is actually needed

SiteFort helps with safer WordPress hardening, including reducing user enumeration and applying security controls without blindly breaking modern WordPress features.

11. Filter Dangerous Request Methods

Most WordPress websites only need standard request methods such as GET, POST, and sometimes HEAD. Methods such as TRACE and TRACK should usually be blocked.

For Apache:


# Block TRACE and TRACK
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK) [NC]
    RewriteRule ^ - [F]
</IfModule>

For Nginx:


if ($request_method ~* ^(TRACE|TRACK)$) {
    return 403;
}

This is a small server-level hardening step that reduces unnecessary attack surface.

12. Filter Suspicious Requests

Attackers and bots often send suspicious query strings while looking for vulnerable plugins, local file inclusion bugs, SQL injection, exposed configuration files, and old exploit paths.

Filtering suspicious requests can help reduce automated attack traffic, but rules must be applied carefully. Overly aggressive rules can block legitimate plugin, checkout, search, or API behavior.

Instead of copying large generic rule sets without testing, use a firewall that understands WordPress behavior and allows you to review blocked requests.

SiteFort’s firewall helps with this layer by blocking suspicious request patterns, abusive IPs, user agents, countries, bad bots, vulnerability probes, and repeated 404 scanning. It also keeps logs so you can review what was blocked and adjust rules if needed.

13. Reduce WordPress Version Exposure

Removing the visible WordPress version number can reduce some automated fingerprinting, but it should not be treated as strong protection.

Attackers can often identify WordPress versions through files, assets, behavior, or known plugin/theme fingerprints. The real protection is keeping WordPress updated.

You can remove the generator tag with:


remove_action('wp_head', 'wp_generator');
add_filter('the_generator', '__return_empty_string');

Be careful when removing version query strings from all scripts and styles. Some caching and browser behavior depends on asset versions for proper cache busting. Removing them may cause old CSS or JavaScript to stay cached longer than expected.

SiteFort focuses on more practical protection: vulnerability alerts, hardening, firewall rules, login protection, malware scanning, and activity monitoring.

14. Disable Public Error Display

Error messages can reveal server paths, plugin names, theme files, database errors, or other technical details. These details may help attackers understand the site structure.

On production websites, errors should be logged privately instead of displayed publicly.

In wp-config.php, you can use:


define('WP_DEBUG', false);
define('WP_DEBUG_DISPLAY', false);
@ini_set('display_errors', 0);

For troubleshooting, enable debugging temporarily on a staging site or log errors privately instead of showing them to visitors.

15. Add Important Security Headers

Security headers help browsers enforce safer behavior when visitors interact with your website.

Common useful headers include:

  • Strict-Transport-Security
  • X-Content-Type-Options
  • X-Frame-Options or Content-Security-Policy frame rules
  • Referrer-Policy
  • Permissions-Policy
  • Content-Security-Policy, when properly tested

Do not add a strict Content Security Policy without testing. A badly configured CSP can break scripts, analytics, forms, payment flows, or third-party services.

SiteFort can help identify missing security headers as part of WordPress hardening, while more advanced header policies should be tested carefully based on your site setup.

16. Scan for Malware and Backdoors

Hardening helps reduce risk, but it does not guarantee that a site is already clean.

Regular malware scanning helps detect:

  • Backdoors
  • Web shells
  • Malicious PHP files
  • Injected JavaScript
  • SEO spam
  • Suspicious redirects
  • Modified core files
  • Exposed sensitive files
  • Vulnerable plugins and themes

SiteFort uses a performance-focused, hash-first scanning approach with cloud-assisted malware analysis for suspicious files. This helps keep scans lightweight while still checking for threats that are easy to miss during manual review.

17. Monitor Activity and Security Logs

Security logs help you understand what happened before, during, and after an incident.

Useful events to monitor include:

  • Successful logins
  • Failed login attempts
  • New user creation
  • User role changes
  • Plugin installation or deletion
  • Theme changes
  • Firewall blocks
  • Hardening setting changes
  • Malware scan results
  • Vulnerability findings

SiteFort includes audit logs so site owners can track important security events from the WordPress dashboard and investigate suspicious activity faster.

18. Use Cloudflare or Edge Protection

Cloudflare and similar edge providers can help reduce bad traffic before it reaches your hosting server.

This is especially useful for:

  • DDoS protection
  • Bot filtering
  • Country-level blocking
  • IP reputation filtering
  • Rate limiting
  • Challenge pages
  • Cached static assets

If your website uses Cloudflare, SiteFort’s Cloudflare Sync can push selected blocking rules to the edge. This helps stop some abusive traffic earlier instead of waiting until it reaches WordPress.

19. Use a Layered WordPress Security Setup

There is no single setting that makes WordPress fully secure. Good security comes from layers.

A strong WordPress security setup should include:

  • Secure hosting
  • Regular updates
  • Strong passwords
  • Two-factor authentication
  • Login attempt protection
  • Safe file permissions
  • Protection for sensitive files
  • Blocked PHP execution in upload directories
  • XML-RPC restriction where appropriate
  • Safe REST API controls
  • Firewall protection
  • Bot blocking
  • Vulnerability monitoring
  • Malware scanning
  • Audit logs
  • Backups
  • Cloudflare or edge protection where possible

This is exactly the kind of workflow SiteFort is built for. Instead of manually editing multiple server files and installing several separate tools, SiteFort Security Plugin brings hardening, firewall protection, login security, malware scanning, vulnerability alerts, audit logs, and Cloudflare Sync into one WordPress security dashboard.

You can also install SiteFort from the official WordPress.org plugin directory.

Final Thoughts

Securing WordPress is not a one-time task. It is an ongoing process of reducing risk, keeping software updated, monitoring activity, and responding quickly when something looks suspicious.

Manual hardening can work well for experienced site owners and developers, but it can also be risky if rules are copied without understanding the server environment. A bad rule can break uploads, REST API requests, checkout pages, plugin features, or admin functionality.

For most site owners, the safer approach is to use a trusted WordPress security plugin and only apply manual server rules when needed.

SiteFort helps simplify this process with practical WordPress security controls: hardening, firewall rules, bot blocking, login protection, 2FA, vulnerability alerts, malware scanning, audit logs, and Cloudflare Sync.

You may also find these guides helpful: