How to Secure a WordPress Website: Hardening Checklist

Short answer: To secure WordPress: keep core, themes and plugins updated, delete unused ones, use unique admin usernames, strong passwords and 2FA, protect the login page, disable file editing in the dashboard, set correct file permissions, use a firewall, take off-site backups and run on secure hosting with HTTPS.

WordPress itself is reasonably secure. Most hacked WordPress sites are hacked through outdated plugins, weak passwords or nulled (pirated) themes. Here is the hardening I apply on client sites.

Updates and software

1. Update WordPress core, plugins and themes regularly
2. Enable automatic updates for minor security releases
3. Delete (not just deactivate) unused plugins and themes
4. Never install nulled plugins or themes. They often contain malware.
5. Choose plugins that are actively maintained and widely used

Users and logins

1. Don’t use “admin” as a username
2. Strong unique passwords for every user
3. Two-factor authentication for all admins
4. Give users the lowest role they need
5. Limit login attempts and add a custom login URL. I built Secure Custom Login and Professional Login for this.

Configuration

1. Disable the dashboard file editor by adding to wp-config.php:

define( 'DISALLOW_FILE_EDIT', true );

1. Use unique security keys and salts in wp-config.php
2. Change the default wp_ database prefix on new installs
3. Set file permissions: typically 644 for files, 755 for folders, stricter for wp-config.php
4. Disable XML-RPC if you don’t use it
5. Turn off directory listing
6. Add security headers (HSTS, X-Content-Type-Options, frame protection)

Protection and recovery

1. Use a web application firewall
2. Run malware scans
3. Daily off-site backups with tested restores
4. Use HTTPS everywhere
5. Monitor uptime and file changes

Comments and spam

If you don’t use comments, turn them off completely. Spam comments add risk and database bloat. My Disable & Delete Comments plugin does it in one click.

If your WordPress site is hacked

1. Put the site in maintenance mode
2. Change all passwords: hosting, database, WordPress users, FTP/SFTP
3. Restore a clean backup, or reinstall core and plugins from official sources
4. Remove unknown admin users and suspicious files
5. Update everything and find the entry point
6. Ask Google to review the site in Search Console if it was flagged

For broader advice beyond WordPress, see website security for small businesses.

Frequently asked questions

Is WordPress safe to use?

Yes, when it is updated, uses trusted plugins, strong logins and good hosting. Most problems come from neglect.

Do I need a WordPress security plugin?

It helps, especially for firewall, login protection and scanning. Hosting-level security can cover some of the same ground.

How do I know if my WordPress site is hacked?

Warning signs include unknown admin users, strange redirects, spam pages in Google, a Google “site may be hacked” warning, or a sudden traffic drop.

Can you secure my WordPress site?

Yes. I harden, clean and maintain WordPress sites. Get in touch.

Written by Syed Imran Murtaza

Freelance software engineer and web developer in Karachi, Pakistan (also known as CtrlAltImran). I build websites, web apps, custom WordPress plugins and AI tools for clients worldwide. About me · Hire me · My work

Let’s talk