Most WordPress security guides are written for a global audience. This one is written for Indian businesses \u2014 where the threat landscape, hosting environment, and compliance requirements have specific nuances worth addressing separately.<\/p>\n
India is now the third-largest source of WordPress installations globally. That makes Indian sites a target. Specific risks include:<\/p>\n
Before hardening WordPress itself, check your hosting situation:<\/p>\n
Are you on shared hosting?<\/strong> If yes, you share server resources with potentially hundreds of other sites. One compromised neighbour can affect you. Consider:<\/p>\n Is your PHP version current?<\/strong> PHP 7.4 is the minimum for WordPress 7.0 but PHP 8.3 is recommended. Older PHP versions have unpatched CVEs. Check in cPanel \u2192 MultiPHP Manager.<\/p>\n Is your MySQL version 8.0+?<\/strong> MySQL 5.7 is end-of-life and has known vulnerabilities. Ask your host to upgrade or migrate.<\/p>\n Add to your Also move Indian sites attract specific bot patterns. Add these rules to Indian contact forms are heavily targeted for phone number and email harvesting. Implement these protections:<\/p>\n Add Google reCAPTCHA v3<\/strong> to all forms \u2014 it’s invisible to real users but blocks most bots. Most form plugins (WPForms, Gravity Forms, CF7) support it natively.<\/p>\n Honeypot fields:<\/strong> Add a hidden field that real users don’t fill but bots do:<\/p>\n Rate limit form submissions<\/strong> \u2014 no real user submits a contact form 10 times per minute. Use Contact Form 7 + Flamingo with submission limits, or implement server-side rate limiting.<\/p>\n Change the table prefix.<\/strong> The default Limit database user permissions.<\/strong> Your WordPress database user only needs SELECT, INSERT, UPDATE, DELETE. It should not have DROP, CREATE, or ALTER permissions in production:<\/p>\n India’s Digital Personal Data Protection Act 2023 is now in effect. For WordPress sites collecting user data:<\/p>\n At minimum, update your Privacy Policy to reference the DPDP Act and add explicit consent checkboxes to all data collection forms.<\/p>\n Security without monitoring is incomplete. Set up:<\/p>\n Wordfence free tier<\/strong> \u2014 malware scanning and login alerts. Configure email alerts for:<\/p>\n UptimeRobot (free)<\/strong> \u2014 monitors your site every 5 minutes and sends SMS\/email if it goes down. A sudden downtime often indicates a compromise or server-level attack.<\/p>\n Google Search Console alerts<\/strong> \u2014 Google will email you if it detects malware or hacked content on your site. Make sure Search Console is set up and email notifications are enabled.<\/p>\n\n
Step 2 \u2014 Secure wp-config.php<\/h2>\n
wp-config.php<\/code> contains your database credentials. It should never be publicly accessible.<\/p>\n.htaccess<\/code> file:<\/p>\n# Protect wp-config.php\r\n<files wp-config.php>\r\n order allow,deny\r\n deny from all\r\n<\/files>\r\n\r\n# Disable directory browsing\r\nOptions -Indexes\r\n\r\n# Block access to sensitive files\r\n<FilesMatch \"(^#.*#|\\.(bak|config|dist|fla|inc|ini|log|psd|sh|sql|sw[op])|~)$\">\r\n Order allow,deny\r\n Deny from all\r\n Satisfy All\r\n<\/FilesMatch><\/code><\/pre>\nwp-config.php<\/code> one directory above your WordPress root if your hosting supports it \u2014 WordPress automatically looks for it there.<\/p>\nStep 3 \u2014 India-Specific Bot Blocking<\/h2>\n
.htaccess<\/code>:<\/p>\n# Block common malicious bots\r\n<IfModule mod_rewrite.c>\r\n RewriteEngine On\r\n RewriteCond %{HTTP_USER_AGENT} (libwww-perl|wget|python|nikto|curl|scan|java|winhttp|clshttp|loader) [NC,OR]\r\n RewriteCond %{HTTP_USER_AGENT} (%0A|%0D|%27|%3C|%3E|%00) [NC,OR]\r\n RewriteCond %{HTTP_USER_AGENT} (;|<|>|'|\"|\\)|\\(|%0A|%0D|%22|%27|%28|%3C|%3E|%00).*(libwww-perl|wget|python|nikto|curl|scan|java|winhttp|clshttp|loader) [NC]\r\n RewriteRule .* - [F,L]\r\n<\/IfModule><\/code><\/pre>\nStep 4 \u2014 Protect Contact Forms from OTP Scrapers<\/h2>\n
\/\/ Add to your form (hidden via CSS, not display:none)\r\n<input type=\"text\" name=\"website_url\" style=\"position:absolute;left:-9999px;\" tabindex=\"-1\" autocomplete=\"off\"><\/code><\/pre>\nStep 5 \u2014 Database Security<\/h2>\n
wp_<\/code> prefix is known to every attacker. Change it during install, or use a plugin like Brozzme DB Prefix & Tools Addon to change it on existing sites.<\/p>\n-- Run in phpMyAdmin\r\nREVOKE CREATE, DROP, ALTER, INDEX ON wordpress_db.* FROM 'wp_user'@'localhost';\r\nFLUSH PRIVILEGES;<\/code><\/pre>\nStep 6 \u2014 DPDP Act 2023 Compliance Basics<\/h2>\n
\n
Step 7 \u2014 Monitoring and Alerting<\/h2>\n
\n
Quick Hardening Checklist<\/h2>\n
\n\n
\n \nAction<\/th>\n Priority<\/th>\n Cost<\/th>\n<\/tr>\n<\/thead>\n \n Update WordPress, themes, plugins<\/td>\n Critical<\/td>\n Free<\/td>\n<\/tr>\n \n Change default admin username<\/td>\n Critical<\/td>\n Free<\/td>\n<\/tr>\n \n Enable 2FA on all admin accounts<\/td>\n Critical<\/td>\n Free<\/td>\n<\/tr>\n \n Install SSL certificate<\/td>\n Critical<\/td>\n Free<\/td>\n<\/tr>\n \n Protect wp-config.php via .htaccess<\/td>\n High<\/td>\n Free<\/td>\n<\/tr>\n \n Change database table prefix<\/td>\n High<\/td>\n Free<\/td>\n<\/tr>\n \n Set up Cloudflare WAF<\/td>\n High<\/td>\n Free<\/td>\n<\/tr>\n \n Configure automated backups<\/td>\n High<\/td>\n Free<\/td>\n<\/tr>\n \n Add reCAPTCHA to forms<\/td>\n Medium<\/td>\n Free<\/td>\n<\/tr>\n \n Limit database user permissions<\/td>\n Medium<\/td>\n Free<\/td>\n<\/tr>\n \n Set up uptime monitoring<\/td>\n Medium<\/td>\n Free<\/td>\n<\/tr>\n \n DPDP Act compliance review<\/td>\n Medium<\/td>\n Free\/Legal fees<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n