WordPress Hardening Checklist

WordPress powers a huge share of the web, which makes it a favourite target for automated attacks. The core software is well maintained — most compromises come from outdated plugins, weak logins and careless configuration. This checklist covers the practical steps that close those gaps, in priority order.

1. Keep core, themes and plugins updated

Outdated components are the number-one cause of WordPress compromises. Enable automatic updates for core and, where you trust them, for plugins and themes too. Review the rest weekly. Delete any theme or plugin you are not actively using — even deactivated code on disk can be exploited if it contains a known flaw.

2. Lock down the login

The wp-login.php page is hammered by bots constantly. Harden it:

• Use strong, unique passwords for every account.
• Enable two-factor authentication (2FA) for all administrators.
• Limit login attempts to blunt brute-force attacks.
• Avoid the default admin username.
• Where practical, restrict access to the admin area by IP.

3. Run fewer plugins, from trusted sources

Every plugin is code running on your site, and each one is a potential entry point. Install only what you genuinely need, and only from reputable sources — the official directory or established commercial vendors with a track record of prompt security updates. Avoid abandoned plugins that haven’t been updated in a long time, and never install nulled or pirated premium plugins, which frequently hide malware.

Area	Action	Priority
Updates	Auto-update core; review plugins weekly	High
Login	2FA + limit attempts + strong passwords	High
Plugins	Minimal, trusted, maintained	High
File editing	Disable the dashboard editor	Medium
Headers	Add security headers	Medium
Backups	Automated, off-site, tested	High

4. Disable the built-in file editor

By default, an administrator can edit theme and plugin code straight from the dashboard. If an admin account is ever hijacked, that editor becomes an easy way to inject malicious code. Turn it off by adding this line to wp-config.php:

define('DISALLOW_FILE_EDIT', true);

You’ll still edit files over SFTP when you need to, but attackers lose a convenient tool.

5. Add security headers and enforce HTTPS

Make sure the whole site is served over HTTPS and add HTTP security headers to defend against cross-site scripting and clickjacking. On Apache-based hosts you can set them in .htaccess; many managed WordPress hosts and CDNs let you set them at the edge. Verify the result with our free headers check.

6. Back up — and test restores

Keep automated, off-site backups of both files and the database, retain several versions, and periodically test a restore so you know it works. If WordPress is ever compromised, a clean recent backup is often the fastest safe way back.

Keep it maintained

Hardening is not one-and-done. Schedule updates, backup checks and a periodic scan so drift doesn’t creep back in. For the underlying weaknesses these steps address, see common website vulnerabilities and the broader security basics.

Frequently asked questions

Related guides