Security
WordPress runs ~40% of the web, which makes it the favourite target for opportunistic attackers. The basics still cover most real incidents: keep core/plugins/themes patched, use strong unique passwords (or SSO), restrict wp-admin by IP or 2FA, disable file editing, harden file permissions, and put a web application firewall in front. None of this is exotic — and missing any one is how most sites get popped.
A defence-in-depth checklist with config snippets
EXAMPLE
// wp-config.php — security hardening that costs nothing
// 1) Stop in-browser plugin/theme editing
define('DISALLOW_FILE_EDIT', true);
define('DISALLOW_FILE_MODS', true); // also blocks plugin/theme install/update via wp-admin
// 2) Force HTTPS for admin and login
define('FORCE_SSL_ADMIN', true);
// 3) Rotate salts — re-run https://api.wordpress.org/secret-key/1.1/salt/
define('AUTH_KEY', '...');
define('SECURE_AUTH_KEY', '...');
// ... and so on
// 4) Limit post revisions to keep wp_posts tidy
define('WP_POST_REVISIONS', 10);
// 5) Disable XML-RPC if you do not need it (legacy attack surface)
add_filter('xmlrpc_enabled', '__return_false');
// .htaccess (Apache) — restrict wp-admin to office IPs
# <Files "wp-login.php">
# Require ip 203.0.113.0/24
# Require ip 198.51.100.42
# </Files>
// nginx — same idea
# location /wp-admin {
# allow 203.0.113.0/24;
# allow 198.51.100.42;
# deny all;
# }
// File permissions baseline (run as the site user, not root)
// find . -type d -exec chmod 755 {} \;
// find . -type f -exec chmod 644 {} \;
// chmod 600 wp-config.php
// WP-CLI: enforce strong logins via plugins, then verify
// wp plugin install two-factor --activate
// wp plugin install limit-login-attempts-reloaded --activate
// wp user list --role=administrator --format=table
// wp user reset-password $admin_login --skip-email # force rotation
// Behind a CDN/WAF (Cloudflare, AWS WAF, BunkerWeb), enable:
// - rate limiting on /wp-login.php
// - bot fight mode / managed challenge for /xmlrpc.php
// - OWASP CRS managed rules
// Backups (off-host, restore-tested!) — never optional for a public WordPress site
// wp db export - | gzip | aws s3 cp - s3://backups/wp/$(date +%F).sql.gz
Why it matters
Patch latency is the single best predictor of whether a WordPress site stays compromised. Automate core + plugin updates inside a maintenance window with a staging clone running the same versions, so the production update is boring rather than feared. If updates feel scary, they are not happening often enough.
Tip: Tweak the snippet with Try it Yourself », then sit the quiz at the bottom of the page.
Example
Example
# Updates, strong admin password, 2FA, limit login attempts, security plugin (Wordfence, iThemes).Try it Yourself »
Discussion
Loading…