Hardening WordPress, step by step

Updates first

Most hacks don't come from sophisticated attacks but from known flaws in plugins or themes that weren't updated. So hardening starts here, before any security plugin.

Turn on automatic security updates for core, update plugins and themes only from their official sources, and delete everything you don't use; a deactivated plugin is still on the server and can be exploited.

Avoid nulled copies of premium plugins entirely; they're one of the most common ways backdoors get planted. If a plugin has been abandoned for years with no updates, look for an alternative.

wp plugin list --update=available && wp theme list --update=available

Accounts and permissions

Every admin account is a full door into your site. Keep admins to a minimum and give everyone else lower roles, such as editor or author, based on what they actually need.

Turn on two-factor login for every admin, use long unique passwords from a password manager, and remove former staff and temporary developers as soon as their work ends.

Review the user list monthly; a forgotten account, or one you don't know who created, is among the first things an attacker looks for.

Files and execution

Disable theme and plugin file editing from the dashboard, so that if an admin account is stolen the attacker can't plant code straight from the browser.

Block PHP execution inside the uploads folder, which is meant for images and files only; any PHP there is a red flag. Set file permissions: 644 for files, 755 for folders, and 600 for wp-config.php where your host allows it.

define( 'DISALLOW_FILE_EDIT', true );

# wp-content/uploads/.htaccess
<FilesMatch "\.(php|phtml|phar)$">
  Require all denied
</FilesMatch>

Headers and secure transport

Make the whole site run on HTTPS with no exceptions, and fix any images or scripts still loading over http.

Once HTTPS is stable, enable HSTS and add basic security headers such as X-Frame-Options and X-Content-Type-Options, then a CSP tuned to your site. Generate the snippet with the headers tool here and test it on staging first; a wrong CSP can break parts of the site.

Backups and monitoring

A backup you've never tried restoring isn't a backup. Keep daily off-site copies, more than one older version, and test a restore every few months on a staging site.

Turn on alerts for account and file changes, and keep an eye on Search Console; catching problems early makes them much smaller and cheaper.