WordPress security improves when common risks are reduced systematically: outdated software, weak credentials, excessive administrator access, unsafe file permissions, exposed services and unreliable backups. These hardening steps focus on practical controls without pretending any single setting makes a site attack-proof.
Outdated or vulnerable plugins, themes and core files can increase WordPress security risk. Keep WordPress core, plugins and themes on a regular update routine that matches the site's risk and change frequency. Review abandoned or unsupported components and replace them when they create an avoidable security or compatibility risk. See our full guide on updating WordPress safely.
Use a reputable password manager to generate and store strong, unique passwords for WordPress administrator accounts, hosting, SFTP/FTP and other privileged access. Avoid reusing passwords across services, and use the provider's supported authentication controls where available.
Use a reputable WP 2FA or Wordfence option and enable two-factor authentication for administrator accounts where practical. Two-factor authentication adds an important second barrier if a password is exposed, although it should be combined with strong credentials and secure account recovery.
Wordfence Security is one example of a plugin that can provide firewall, malware-scanning and login-protection features. Configure any security plugin carefully so its login limits, alerts and firewall rules suit the site without creating unnecessary lockouts.
Using a predictable administrator username can make credential attacks easier to target, so avoid default or easily guessed account names where practical. Create a new admin user with a different username, log in with it, and delete the old "admin" account (reassigning its content to the new account).
Brute-force attacks try thousands of password combinations. Use Wordfence or the Limit Login Attempts Reloaded plugin to block IP addresses after a set number of failed login attempts (the threshold should be chosen to reduce abuse without creating unnecessary lockouts).
XML-RPC can be abused on some sites, but it is also used by legitimate integrations. If the site does not need XML-RPC, consider restricting or disabling it only after checking whether Jetpack, mobile publishing or another connected service depends on it.
Every site should be running on HTTPS. Most hosting providers offer free SSL certificates via Let's Encrypt. Once installed, force HTTPS by adding a redirect in .htaccess or by using the Really Simple SSL plugin.
Incorrect file permissions are a significant security risk. Directories should be set to 755, files to 644, and wp-config.php to 400 or 440.
Add the following to the top of your .htaccess to block direct access to sensitive files:
A current clean backup is your ultimate safety net. Without one, a hack can mean total data loss. Use UpdraftPlus (free) to schedule automatic daily or weekly backups to off-site storage (Google Drive, Dropbox, or Amazon S3). See our full guide on WordPress backup frequency.
Exposing your WordPress version helps attackers target known vulnerabilities. Add this to your theme's functions.php to remove it from page source and feeds:
How long does WordPress security hardening take?
Most of the steps above can be completed in 1–2 hours. Installing Wordfence, enabling 2FA, and updating passwords takes under 30 minutes. The technical steps like file permissions and .htaccess rules take a bit longer but are one-time tasks.
Do I need a security plugin if I follow all these steps?
Yes. A security plugin like Wordfence provides real-time firewall protection and malware scanning that can't be replicated manually. Think of the other steps as hardening the locks — the security plugin is the alarm system.
My site was already hacked. Do these steps help?
These steps prevent future attacks but won't clean an existing infection. First, clean the malware (restore from a clean backup or hire a professional), then apply these hardening measures so it doesn't happen again.
I'll implement all 12 of these steps, run a full security scan, and give you a written report of everything done.
Get WordPress Security Help