3 min read

WordPress runs more than 40% of all websites, so it’s the CMS bots target most. GoZen WordPress hosting includes a server-level web application firewall and malware scanning (Imunify360 or cPGuard, depending on the server), but application-level security is up to you. Most attacks are automated: bots try default usernames, known plugin vulnerabilities and weak passwords. The steps below block most of them.

WordPress security hardening

The Basics (Do These First)

1. Keep Everything Updated

Outdated plugins and themes are the most common way in.

  • Core: keep auto-updates on for minor releases (on by default since WordPress 3.7)
  • Plugins: enable auto-updates for all plugins: Plugins → check the plugin → Enable auto-updates
  • Themes: delete any themes you’re not using. Keep only your active theme and one default theme (like Twenty Twenty-Five)

2. Use Strong Credentials

Don’tDo
Username: adminA unique username (your first name, a nickname)
Password: password12316+ character password from a password manager
Same password everywhereUnique password per site

If you’re still using admin as your username, create a new admin user with a different name, log in as the new user, and delete admin.

3. Enable Two-Factor Authentication

Install Two-Factor (free, lightweight) or Wordfence (includes 2FA plus more).

See Enabling Two-Factor Authentication for details.

File-Level Hardening

Protect wp-config.php

Move it one level up (WordPress looks there automatically):

  mv /home/username/public_html/wp-config.php /home/username/wp-config.php

Or block access via .htaccess:

  <Files wp-config.php>
    Require all denied
</Files>

Disable File Editing

WordPress has a built-in file editor that lets anyone with admin access edit theme and plugin files. Disable it:

  // Add to wp-config.php
define('DISALLOW_FILE_EDIT', true);

Prevent PHP Execution in Uploads

Attackers often upload malicious PHP files disguised as images. Block PHP execution in the uploads folder:

Create /wp-content/uploads/.htaccess:

  <Files "*.php">
    Require all denied
</Files>

Login Hardening

Limit Login Attempts

Install Limit Login Attempts Reloaded (free) or use Wordfence. It blocks IPs after repeated failed logins, much like Fail2Ban does for SSH.

Change the Login URL

Bots probe the default /wp-admin and /wp-login.php URLs constantly. Change them with WPS Hide Login:

  1. Install and activate WPS Hide Login
  2. Go to Settings → WPS Hide Login
  3. Set a custom URL (e.g., /my-login)

Disable XML-RPC

XML-RPC is an older API that most sites don’t need, and it’s often used for brute-force attacks. Disable it unless a service you use (such as the Jetpack app) depends on it:

  # Add to .htaccess
<Files xmlrpc.php>
    Require all denied
</Files>

Security Plugins

Install only one security plugin; running two usually causes conflicts.

PluginBest ForFree Tier
WordfenceAll-in-one (firewall + scanner + 2FA)Yes (strong)
Solid SecurityHardening checklistsYes
Sucuri SecurityMalware scanning and cleanupYes (scanner only)

Security Checklist

After setting up your WordPress site, run through this:

  • WordPress, plugins, and themes all updated
  • auto-updates enabled for plugins
  • admin username changed
  • Strong password (16+ characters)
  • Two-factor authentication enabled
  • wp-config.php protected
  • File editing disabled (DISALLOW_FILE_EDIT)
  • PHP execution blocked in /uploads/
  • Login attempts limited
  • XML-RPC disabled
  • Unused plugins and themes deleted
  • SSL active (HTTPS)
  • A security plugin installed and configured

What to Do Next

Last updated 21 Oct 2026, 00:00 +0300. history

Was this page helpful?