Most WordPress sites get hacked not because of sophisticated attacks \u2014 but because of basic security steps that were never taken.<\/p>\n
This checklist covers the 10 most important things you can do right now to harden your WordPress site. No security expertise required.<\/p>\n
This is the single most important security step and the one most commonly skipped.<\/p>\n
Over 60% of hacked WordPress sites were running outdated software at the time of the breach. Updates patch known vulnerabilities \u2014 leaving them unpatched is like locking your front door but leaving the window open.<\/p>\n
What to do:<\/strong><\/p>\n “admin123” and “softcrony2024” are not passwords. They’re invitations.<\/p>\n Every WordPress account \u2014 admin, editor, author \u2014 needs a unique, randomly generated password of at least 16 characters. Use a password manager like Bitwarden (free) or 1Password to generate and store them.<\/p>\n What to do:<\/strong><\/p>\n When WordPress is installed, the default username is often “admin”. Attackers know this and use it as the first guess in brute force attacks.<\/p>\n What to do:<\/strong><\/p>\n Even if an attacker gets your password, 2FA stops them from logging in without physical access to your phone or authenticator app.<\/p>\n What to do:<\/strong><\/p>\n By default, WordPress allows unlimited login attempts. This makes brute force attacks \u2014 trying thousands of password combinations \u2014 trivially easy.<\/p>\n What to do:<\/strong><\/p>\n If your site still runs on HTTP instead of HTTPS, fix this immediately. An SSL certificate encrypts data between your site and visitors \u2014 and Google actively penalises sites without it.<\/p>\n What to do:<\/strong><\/p>\n XML-RPC is a WordPress feature that allows remote connections \u2014 including the Jetpack plugin and mobile apps. If you don’t use these, XML-RPC is just an open attack surface.<\/p>\n Attackers use XML-RPC to run brute force attacks because it allows multiple login attempts per request, bypassing login attempt limits.<\/p>\n What to do:<\/strong> Or install the Disable XML-RPC<\/strong> plugin if you’re not comfortable editing Incorrect file permissions are a common entry point for attackers. WordPress files and folders should have specific permission levels.<\/p>\n Correct permissions:<\/strong><\/p>\n What to do:<\/strong><\/p>\n No security measure is 100% effective. Backups are your last line of defence \u2014 but only if they’re automatic, recent, and stored somewhere other than your main server.<\/p>\n What to do:<\/strong><\/p>\n A WAF filters malicious traffic before it reaches your WordPress site \u2014 blocking known attack patterns, bad bots, and suspicious requests.<\/p>\n Free options:<\/strong><\/p>\n What to do:<\/strong><\/p>\n For every WordPress site we build or maintain, these 10 steps are part of our standard delivery checklist. Security isn’t an add-on \u2014 it’s built into the process from day one.<\/p>\n\n
2. Use Strong, Unique Passwords and a Password Manager<\/h3>\n
\n
3. Change the Default Admin Username<\/h3>\n
\n
4. Enable Two-Factor Authentication<\/h3>\n
\n
5. Limit Login Attempts<\/h3>\n
\n
6. Install an SSL Certificate<\/h3>\n
\n
7. Disable XML-RPC If You Don’t Use It<\/h3>\n
\nAdd this to your .htaccess<\/code> file:<\/p>\n# Disable XML-RPC\r\n<Files xmlrpc.php>\r\n Order Deny,Allow\r\n Deny from all\r\n<\/Files><\/code><\/pre>\n<\/div>\n<\/div>\n.htaccess<\/code>.<\/p>\n8. Set Correct File Permissions<\/h3>\n
\n
755<\/code><\/li>\n644<\/code><\/li>\nwp-config.php<\/code>: 440<\/code> or 400<\/code><\/li>\n<\/ul>\n\n
wp-config.php<\/code> \u2192 Change Permissions \u2192 set to 440<\/li>\n9. Regular Backups \u2014 Automated and Off-Site<\/h3>\n
\n
10. Use a Web Application Firewall (WAF)<\/h3>\n
\n
\n
Quick Reference Checklist<\/h3>\n
\n\n
\n \nStep<\/th>\n Done?<\/th>\n<\/tr>\n<\/thead>\n \n WordPress, themes, plugins updated<\/td>\n \u2610<\/td>\n<\/tr>\n \n Strong unique passwords on all accounts<\/td>\n \u2610<\/td>\n<\/tr>\n \n Default admin username changed<\/td>\n \u2610<\/td>\n<\/tr>\n \n Two-factor authentication enabled<\/td>\n \u2610<\/td>\n<\/tr>\n \n Login attempts limited<\/td>\n \u2610<\/td>\n<\/tr>\n \n SSL certificate active<\/td>\n \u2610<\/td>\n<\/tr>\n \n XML-RPC disabled<\/td>\n \u2610<\/td>\n<\/tr>\n \n File permissions correct<\/td>\n \u2610<\/td>\n<\/tr>\n \n Automated off-site backups running<\/td>\n \u2610<\/td>\n<\/tr>\n \n WAF enabled (Cloudflare or Wordfence)<\/td>\n \u2610<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n How We Handle Security at Softcrony<\/h3>\n