Quick answer
Use this practical WordPress security hardening checklist to strengthen your website with secure accounts, updates, backups, access controls, monitoring, and other essential protections.
WordPress security hardening is one of the most important steps you can take to reduce the risk of hacking, malware, unauthorized access, and other website security problems.
A secure WordPress website does not depend on one plugin or one setting. Effective hardening uses multiple layers of protection, including software updates, strong authentication, limited user permissions, backups, firewall protection, secure configuration, and ongoing monitoring.
This WordPress security hardening checklist covers 15 practical steps you can use to strengthen a WordPress website and reduce common security risks.
Quick answer: To harden WordPress, keep WordPress core, plugins, and themes updated, remove unused software, use strong unique passwords and two-factor authentication, limit administrator access, protect the login area, disable unnecessary file editing, use HTTPS, maintain tested backups, add firewall protection, secure important files, and monitor your website for suspicious activity.
What Is WordPress Security Hardening?
WordPress security hardening means strengthening your website's configuration and access controls so attackers have fewer opportunities to compromise it.
Hardening does not mean making a website impossible to hack. No security measure can guarantee that. Instead, the goal is to reduce attack surfaces, limit unnecessary access, protect important data, detect suspicious activity, and make recovery easier if something goes wrong.
WordPress's official security guidance recommends a layered approach that includes keeping software updated, using appropriate user roles, protecting configuration and files, maintaining backups, and using logging and monitoring. Read the official WordPress hardening guidance.
15-Step WordPress Security Hardening Checklist
1. Keep WordPress Core Updated
Running an outdated version of WordPress can leave known security vulnerabilities unpatched.
Check your WordPress dashboard regularly for available updates and apply security updates as soon as reasonably possible.
Automatic updates can help reduce the amount of time a website remains exposed to known issues, although important websites should still be monitored after updates.
WordPress's official documentation identifies keeping WordPress itself and installed plugins and themes updated as one of the most important security practices. See WordPress security guidance.
2. Update Plugins and Themes
Plugins and themes are common parts of the WordPress attack surface. A vulnerable plugin can provide an attacker with a path into the website even when WordPress core is fully updated.
Review plugin and theme updates regularly and remove software that is no longer required.
Use plugins and themes from trusted sources and be cautious with abandoned software that no longer receives security or compatibility updates.
3. Remove Unused Plugins and Themes
An inactive plugin is not automatically harmless.
If you do not need a plugin or theme, remove it instead of leaving it installed indefinitely.
Reducing the number of installed components reduces the amount of software that needs to be monitored and maintained.
4. Use Strong, Unique Passwords
Every important WordPress account should have a strong, unique password.
Do not reuse the same password across WordPress, hosting, email, domain management, or other important services.
A password should not contain predictable information such as your name, username, company name, or website name.
WordPress recommends using strong passwords and provides guidance on creating passwords that are difficult to guess. Review WordPress password best practices.
5. Enable Two-Factor Authentication
A strong password is important, but adding another authentication factor can provide another layer of protection.
Two-factor authentication can help protect an account when a password has been exposed or guessed.
Where practical, enable two-factor authentication for administrator accounts and other critical services connected to your website.
6. Limit Administrator Accounts
Do not give administrator privileges to every person who needs access to the website.
Review your WordPress users regularly and identify accounts that no longer need administrative access.
An unknown administrator account can provide an attacker with persistent control of a website, so administrator accounts deserve special attention during security reviews.
WordPress uses roles and capabilities to control what users can access and change. Learn more about WordPress roles and capabilities.
7. Follow the Principle of Least Privilege
Give users only the permissions they need to perform their work.
For example, someone who only needs to write articles may not need administrator privileges.
Using appropriate roles limits the potential damage if an account is compromised.
Review user permissions when responsibilities change and remove accounts that are no longer required.
8. Protect the WordPress Login
The WordPress login area is a common target for automated attacks and password guessing.
Use strong passwords, two-factor authentication, login protection, and rate limiting where appropriate.
A web application firewall can also help filter malicious traffic before it reaches your WordPress installation.
Avoid relying on changing the login URL as your only security measure. Authentication security, rate limiting, monitoring, and strong credentials are more important layers of protection.
9. Disable Unnecessary File Editing
WordPress includes built-in theme and plugin file editors that can allow users with sufficient privileges to modify code directly from the dashboard.
If you do not need these editors, disabling them can reduce the impact of an administrator account compromise.
WordPress documents the DISALLOW_FILE_EDIT configuration option for disabling dashboard file editing.
define( 'DISALLOW_FILE_EDIT', true );This does not prevent every type of file modification or malware upload, so it should be treated as one hardening layer rather than complete protection.
10. Use HTTPS Everywhere
Your WordPress website should use HTTPS so sensitive communication between visitors, administrators, and the website is encrypted in transit.
Make sure your WordPress site, login area, and important forms use HTTPS correctly and that there are no unnecessary mixed-content problems.
11. Use a Web Application Firewall
A web application firewall, or WAF, can help identify and block malicious requests before they reach your WordPress application.
Depending on the setup, a WAF may operate at the server level, through a security service, or through a WordPress security solution.
A WAF can reduce exposure to automated attacks, malicious requests, and some common exploitation attempts, but it should not replace updates, secure accounts, backups, or monitoring.
12. Maintain Reliable Backups
Backups are an essential part of security because prevention is not perfect.
Maintain backups of both your WordPress files and database. A backup of only the files may not contain everything needed to restore a typical WordPress website.
Your backups should be stored separately from the live website when possible and tested periodically to make sure they can actually be restored.
WordPress's official documentation explains that a typical WordPress backup needs both the website files and database for a complete restoration. Read the WordPress backup documentation.
13. Secure wp-config.php and File Permissions
The wp-config.php file contains important WordPress configuration and database connection information, so it deserves additional protection.
File permissions should allow the required operations while avoiding unnecessarily broad write access.
Do not blindly apply permission values copied from another server. The correct settings depend on the hosting environment and how WordPress is configured.
If you are unsure about file permissions, check your hosting documentation or have an experienced administrator review them.
14. Monitor Files and Security Events
Security hardening should not end after you configure the website.
Monitor important file changes, administrator accounts, login activity, malware scans, and other security events that may indicate suspicious behavior.
Monitoring helps you detect changes that would otherwise remain unnoticed until the website starts showing visible problems.
If you want a more comprehensive review of your website's security configuration and potential weaknesses, a WordPress Security Audit can help identify areas that need attention.
15. Review Logs and Security Alerts
Server and application logs can provide valuable information about suspicious requests, failed login attempts, unexpected file access, and possible exploitation attempts.
If your hosting provider gives you access to logs, review them when investigating unusual activity.
Also pay attention to security warnings from browsers, security tools, your hosting provider, and search engines.
Common WordPress Hardening Mistakes
Relying on One Security Plugin
A security plugin can provide valuable protection, but it cannot replace software updates, secure authentication, backups, access controls, and monitoring.
Keeping Unused Plugins Installed
Unused software increases the amount of code that needs to be maintained. Remove plugins and themes that you no longer need.
Giving Everyone Administrator Access
Administrator privileges should be limited to people who genuinely need them.
Never Testing Backups
A backup that cannot be restored reliably is not a dependable recovery strategy. Test your backups periodically.
Changing Security Settings Without a Backup
Some configuration changes can break website functionality. Create a backup and understand the change before applying it.
Using Security Through Obscurity as the Main Defense
Changing URLs, hiding version information, or using other obscurity techniques may have limited value, but they should never replace strong authentication, updates, access controls, and monitoring.
What WordPress Security Hardening Cannot Do
Security hardening reduces risk, but it cannot make a WordPress website completely immune to attack.
A website can still be compromised through a newly discovered vulnerability, stolen credentials, compromised hosting, malicious code, or another weakness.
The goal is to build multiple layers so that one failed security control does not automatically result in a complete website compromise.
If your website is already showing signs of malware or compromise, hardening should come after the infection has been properly investigated and removed.
If you suspect your website is already infected, you can first check WordPress for malware and then follow a structured recovery process.
If malware is confirmed, professional WordPress Malware Removal can help remove the infection and investigate potential backdoors before security hardening is applied.
WordPress Security Hardening Checklist
| Security Check | Recommended Action |
|---|---|
| WordPress core | Keep it updated |
| Plugins | Update and remove unused plugins |
| Themes | Update and remove unused themes |
| Passwords | Use strong, unique passwords |
| Two-factor authentication | Enable it for important accounts |
| Administrator accounts | Review and limit them |
| User permissions | Use the least privilege necessary |
| Login protection | Use rate limiting and other appropriate controls |
| File editing | Disable unnecessary dashboard file editing |
| HTTPS | Use HTTPS across the website |
| Firewall | Use a suitable WAF |
| Backups | Back up files and database and test restores |
| File permissions | Avoid unnecessarily broad permissions |
| Monitoring | Monitor important changes and security events |
| Logs and alerts | Review suspicious activity and warnings |
Frequently Asked Questions
What is WordPress security hardening?
WordPress security hardening is the process of strengthening your WordPress website's software, accounts, permissions, configuration, and monitoring so attackers have fewer opportunities to compromise it.
What is the most important WordPress security step?
There is no single setting that secures every website. Keeping WordPress, plugins, and themes updated is one of the most important baseline practices, while strong authentication, limited permissions, backups, firewall protection, and monitoring add further layers.
Does a security plugin make WordPress secure?
A security plugin can add useful protections, but it should not be treated as the complete security strategy. Updates, strong authentication, access control, backups, and monitoring are also important.
Should I delete unused WordPress plugins?
Yes. If a plugin is no longer needed, removing it reduces the amount of software that must be maintained and monitored.
Should every WordPress user be an administrator?
No. Users should receive only the permissions required for their work. Limiting administrator privileges reduces the potential impact of a compromised account.
How often should I back up WordPress?
The appropriate frequency depends on how often your website changes and how much data you can afford to lose. More frequently updated websites generally need more frequent backups. Most importantly, keep both files and database backups and test that they can be restored.
Can WordPress security hardening prevent malware?
Hardening can reduce the risk of malware by removing unnecessary attack surfaces and strengthening access controls, but it cannot guarantee that a website will never be compromised. Ongoing updates, monitoring, and incident response are still necessary.
Final Thoughts
WordPress security hardening is not about finding one perfect security setting. It is about building several layers that work together.
Start with the fundamentals: keep WordPress and all extensions updated, remove software you do not need, use strong unique passwords, enable two-factor authentication, limit administrator privileges, protect the login area, maintain reliable backups, and monitor your website.
Then review more advanced areas such as firewall protection, file permissions, configuration security, logging, and security monitoring.
If you need help securing a WordPress website, learn about my WordPress security services, request a WordPress Security Audit, or contact me for a security assessment.
Free security check
Worried your site is infected?
Get a free security assessment — I'll tell you if your WordPress site is compromised and exactly what it needs. No obligation.
Keep reading
How to Recover Your Google Rankings After a Hack
A hack can tank your search rankings. Here's how to recover them once the site is clean.
WordPress Security for Small Businesses: A Practical Guide
You don't need an IT team to secure a small-business WordPress site. Here's a practical, no-jargon plan that covers the essentials.
How to Secure a WooCommerce Store
A WooCommerce store handles money and customer data, which makes it a target. Here's how to secure it without hurting sales.