How to Secure a WordPress Site: A Hardening Checklist

By the BMaiKR team · Updated 2026-10-10

This checklist is for site owners and developers who run WordPress themselves or on a managed server. Every step comes from the official WordPress handbook unless marked as our own practice.

Before you start

• Admin access to WordPress and to the server or hosting panel.
• A fresh backup of the database and all files.
• A staging copy if the site earns revenue.

1. Keep core, plugins and themes updated

Run the latest WordPress version. Minor core updates (maintenance and security releases) install automatically on existing sites by default, and the handbook strongly discourages switching automatic updates off completely.

Update plugins and themes after core, one at a time, and check the site after each one. If a plugin breaks the site, deactivate the non-default plugins and reactivate them one by one to find the cause.

// wp-config.php: 'minor' installs only maintenance and security releases automatically
define( 'WP_AUTO_UPDATE_CORE', 'minor' );

2. Remove what you do not use

Delete plugins and themes you are not using. Install new ones only from the WordPress.org repository or from well-known companies, and avoid plugins that run arbitrary code stored in the database.

3. Harden logins

• Do not use admin or webmaster as a username.
• Use a strong, unique password for every account.
• Turn on two-step authentication. The handbook lists plugins such as Duo, Google Authenticator, Rublon, Two-Factor and Wordfence for this.

4. Set file permissions

The handbook recommends the following values. Your own account should own the files, and only that account should have write access to the web root, /wp-admin/, /wp-includes/ and /wp-content/plugins/.

find /path/to/wordpress/ -type d -exec chmod 755 {} \;
find /path/to/wordpress/ -type f -exec chmod 644 {} \;

5. Protect wp-config.php and turn off the file editor

You can move wp-config.php one directory above the WordPress installation. On Apache you can also deny web access to it in .htaccess.

<Files "wp-config.php">
Require all denied
</Files>

Disable the dashboard code editor so a compromised admin account cannot edit plugin, theme or PHP files. This does not stop malicious uploads, so it is one layer among several.

define( 'DISALLOW_FILE_EDIT', true );

6. Lock down the database

• Use a separate database and database user for every site.
• Change the table prefix from the default wp_ when you install.
• Disable MySQL features you do not need, such as remote TCP connections.
• Grant the application user only SELECT, INSERT, UPDATE and DELETE if you can. The handbook warns that removing DROP, ALTER and GRANT can break updates that change the schema, so only do this with a tested backup plan and restore the privileges temporarily for major updates.

7. Use HTTPS for administration

Require an encrypted connection for the admin area so passwords and session cookies are not sent in clear text.

8. Back up and test the restore

Back up the database and the files together. The handbook suggests weekly backups for small sites and daily backups for busy ones, and a backup before every upgrade or move.

• Keep at least three to five recent backups.
• Store copies in different places, not only on the hosting server.
• Encrypt backups or protect them with read-only media.
• Restore a backup from time to time to prove it works.

Our practice: XML-RPC

The handbook pages above do not cover XML-RPC. In our own hardening we disable it when nothing the client uses depends on it, such as some mobile apps or remote publishing tools. Check what needs it before you switch it off.

Common mistakes

• Updating everything at once, then not knowing which plugin broke the site.
• Keeping deactivated plugins installed.
• Storing the only backup on the same server as the site.
• Never restoring a backup until the day you need it.