Skip to content
EIEnes Ismaili
2 min read

WordPress security: the settings that actually change the outcome

Ten hardening steps, ordered by what they prevent, plus the four things most checklists leave out.

WordPressHardening

Most WordPress security advice is a list of toggles with no reasoning attached. That makes it easy to follow and hard to prioritise, so people do the cheap steps and skip the ones that matter.

Here is the same list, with the why.

The ten that matter

  1. Update WordPress itself. Most compromised sites are running a version with a published fix available. Updates are the cheapest security control you have.
  2. Update plugins and themes, and remove the ones you do not use. An abandoned plugin is an unpatched plugin. Deactivation is not removal.
  3. Run a supported PHP version. Old PHP versions accumulate unfixed vulnerabilities and lose support from plugin authors. This is a hosting decision, not a plugin one.
  4. Use TLS properly. Not just a certificate, but HTTP to HTTPS enforced, HSTS set, and mixed content cleaned up.
  5. Rename the login path. It does not stop a determined attacker, but it removes the noise of automated credential stuffing.
  6. Enable two factor authentication. The single highest value change on this list. It defeats password reuse and credential stuffing in one step.
  7. Limit login attempts. Rate limiting turns an unlimited guessing game into a bounded one.
  8. Hide the version number. Small, and not a control on its own, but it removes a free fingerprinting signal.
  9. Install a security plugin and configure it. A WAF and monitoring layer help, but only after you have configured it to your site rather than leaving the defaults.
  10. Back up regularly, and test the restore. A backup you have never restored is a hope, not a plan.

What most lists leave out

  • Least privilege for users. Most sites have more administrators than they need. Contributors and editors should not be administrators.
  • Staging before updates. Updating a plugin directly on a live site is how a security fix becomes an outage.
  • Logging and monitoring. Knowing a file changed on the web root is worth more than most toggles, because it tells you when something already went wrong.
  • The plugin supply chain. Every plugin is code that runs with your site's privileges. Audit what you install, and remove what you stopped using.

Where I come at this from

I have administered Linux servers behind a hosting provider and tested WordPress on shared hosting, which means I have seen the same failures from both sides: the site owner who did the easy steps, and the server operator who inherited the result.

The list above is not exhaustive. It is the part that changes the odds.

All postsReply by email