WordPress hardening means locking down your WordPress installation so that attackers have fewer ways in and less damage to do if they get in. A default WordPress installation is functional but not secure — it relies on you to add the layers that matter. I have cleaned up compromised WordPress sites and hardened dozens of client installs. This checklist runs through every layer, in order of impact. WordPress.org’s own official hardening documentation is the authoritative reference for core hardening steps covered here.

Why WordPress Hardening Matters

WordPress powers a large share of the web, which makes it the most targeted platform for automated attacks. Bots scan for known vulnerabilities in outdated plugins, default login URLs, and misconfigured file permissions constantly. A site that went untouched for years can be compromised overnight after a plugin vulnerability is disclosed. Hardening is not paranoia — it is maintenance. For the full security strategy behind these steps, the WordPress security guide covers each area in depth.

WordPress Admin Hardening

• Change the default admin username. “admin” is the first username every brute-force bot tries. Create a new administrator account with a unique username, transfer ownership of all posts to it, and delete the original “admin” account.
• Use a strong, unique password. Minimum 16 characters, random, not used anywhere else. Use a password manager. Do not recycle passwords across sites.
• Enable two-factor authentication (2FA). Install a plugin like WP 2FA or use your security plugin’s built-in 2FA. Even if a password is compromised, 2FA blocks the login.
• Limit login attempts. By default, WordPress allows unlimited login attempts. Install Limit Login Attempts Reloaded or configure your security plugin to block IPs after 3–5 failed attempts.
• Change the default login URL. Moving /wp-admin/ to a custom URL (e.g. /manage-site/) eliminates the majority of automated bot traffic that targets the default address.
• Restrict admin dashboard access by IP. If you access your site from a fixed IP, add a rule to your .htaccess or firewall blocking all other IPs from /wp-admin/.

WordPress File and Server Hardening

• Set correct file permissions. Files: 644. Folders: 755. wp-config.php: 600 (or 440 if your host allows). Never set anything to 777 — that grants write access to everyone.
• Protect wp-config.php. Add this to your .htaccess to block direct access:
  <files wp-config.php> order allow,deny deny from all </files>
• Disable file editing from the dashboard. Add define('DISALLOW_FILE_EDIT', true); to wp-config.php. This prevents attackers who gain admin access from editing theme or plugin files through the dashboard.
• Disable directory browsing. Add Options -Indexes to .htaccess. Without this, anyone can browse your directory structure if no index file is present.
• Move wp-config.php above the web root. WordPress will find it automatically one level up. This keeps your database credentials out of the web-accessible directory.

Plugin and Theme Hardening

• Delete all unused plugins and themes. Inactive plugins and themes still have exploitable code. If you are not using them, delete them — not just deactivate.
• Keep everything updated. The majority of WordPress hacks exploit known vulnerabilities in outdated plugins. Enable automatic updates for minor releases and check manually for major updates monthly.
• Only install plugins from trusted sources. WordPress.org repository or established commercial providers (e.g. WooCommerce, Elementor, Gravity Forms). Pirated or nulled plugins almost always contain malware.
• Audit your plugin list regularly. Every plugin you add is a potential attack surface. Keep your list lean — if a plugin does one thing you use once a year, find a code snippet instead.

WordPress Database Hardening

• Change the default table prefix. The default is wp_. SQL injection attacks often target tables by this prefix. Change it during installation, or use a plugin like Brozzme DB Prefix & Tools Addons to change it afterward (always on a backed-up site).
• Use a strong database password. Your wp-config.php contains the database credentials. The password should be as strong as your admin password.
• Disable phpMyAdmin if not in use. If your host provides phpMyAdmin, keep it protected with an additional password layer or restrict access by IP.

SSL, Headers, and Network Hardening

• Force HTTPS everywhere. Add a 301 redirect in .htaccess redirecting all HTTP to HTTPS. Confirm your SSL certificate is valid and auto-renewing. Google’s Page Experience documentation confirms HTTPS as a ranking signal.
• Add security headers. Add these to your .htaccess or via your security plugin:
  • X-Frame-Options: SAMEORIGIN — prevents clickjacking
  • X-Content-Type-Options: nosniff — prevents MIME sniffing
  • Referrer-Policy: strict-origin-when-cross-origin
  • Permissions-Policy: camera=(), microphone=(), geolocation=()
• Install a Web Application Firewall (WAF). Wordfence (free) or Cloudflare (free tier) adds a firewall layer that blocks malicious requests before they reach WordPress. This is the highest-leverage single action you can take for security.

Backup Strategy

Hardening reduces the chance of a compromise. Backups ensure that if one happens, you can recover. For more detail, the step-by-step WordPress security guide covers backup configuration in full. At minimum:

• Daily automated backups of both files and database
• Backups stored off-site — not on the same server (use a cloud storage integration)
• Retention of at least 30 days of backups
• Tested restores — a backup you have never tested is not a backup

Security Monitoring

• Enable file change monitoring. Wordfence and iThemes Security both include file integrity monitoring — you get notified if any core, plugin, or theme file is modified unexpectedly.
• Set up uptime monitoring. Use a free tool like UptimeRobot to alert you within minutes of your site going down — often the first sign of a compromise.
• Review activity logs monthly. WP Activity Log (free plugin) keeps a record of every login, plugin change, and content edit. Review it for anything unusual.

For sites that have already been compromised, the WordPress security tips guide covers cleanup steps and post-hack hardening. For sites that have never been audited, the WordPress security pillar covers the full strategy.

Frequently Asked Questions

What is WordPress hardening?

WordPress hardening is the process of configuring your WordPress installation to reduce its attack surface. It involves securing the admin area, setting correct file permissions, removing unused plugins and themes, adding a firewall, enforcing HTTPS, and setting up monitoring and backups. The goal is to make it significantly harder for automated attacks and manual hackers to compromise your site.

How do I harden WordPress for free?

Several high-impact hardening steps are free: changing the default admin username, enabling 2FA with WP 2FA (free plugin), limiting login attempts with Limit Login Attempts Reloaded (free), installing Wordfence Free for firewall and file monitoring, setting correct file permissions via your hosting cPanel, and adding security headers to .htaccess. These free steps cover the most exploited vulnerabilities.

Does WordPress hardening affect site performance?

Minimal impact when done correctly. A WAF like Cloudflare can actually improve performance by caching content at the edge. Limiting login attempts, disabling file editing, and setting file permissions add no meaningful overhead. The only hardening step that might affect performance is aggressive rate limiting of requests, which is a tuning decision rather than an on/off toggle.

How often should I review WordPress security?

Run a security audit every 3 months at minimum: review plugin list for anything unused or outdated, check file permissions, verify backup completion, and review activity logs. After any major plugin update (especially for security plugins, contact form plugins, or WooCommerce), do an immediate spot-check. After any public disclosure of a vulnerability affecting a plugin you use, update within 24 hours.

What is the most important WordPress hardening step?

Installing a Web Application Firewall (WAF) — either Wordfence or Cloudflare — is the single highest-impact hardening action for most WordPress sites. It blocks malicious traffic before it reaches your application. After that: strong unique passwords, 2FA on the admin account, and keeping everything updated. These four steps address the vast majority of real-world attack vectors.