WordPress Security Hardening: 10 Steps Beyond Just Installing a Plugin

If you would rather have this handled for you, our WordPress security service takes care of this end to end. Most WordPress security guides end at “install a security plugin.” That is useful but incomplete. A security plugin adds a detection layer; it is not a hardening layer. The hardening happens before the plugin even runs, at the server and application level, and it is what separates a site that blocks an attack from one that needs cleaning up after one.

This guide covers WordPress security hardening properly: ten concrete steps that go beyond installing a plugin, plus why each one matters. Applied together, they turn an easy target into a hard one.

Why Hardening Matters More Than a Plugin

A plugin can alert you that an attack is happening. Hardening reduces the chance the attack succeeds in the first place. The two work together, but hardening is the foundation.

Most successful WordPress attacks are automated and opportunistic. They scan millions of sites for any known weakness. Closing those weaknesses in advance is far cheaper than cleaning up afterwards.

The 10 WordPress Security Hardening Steps

1. Disable XML-RPC if You Do Not Use It

XML-RPC is a legacy API that attackers use for brute-force amplification, where one request can try hundreds of password combinations. If nothing on your site needs it, disable it at the application or server level.

2. Enforce Strong Passwords and 2FA

Brute force is the most common attack vector against WordPress. Require strong, unique passwords and two-factor authentication for every editor-level account and above. Our guide on two-factor authentication explains how.

3. Limit Login Attempts

Three failed logins should trigger a temporary block. Blocking at the server level is even more effective than a plugin, because it stops the attacker before WordPress loads. See our guide on WordPress login security for more.

4. Move wp-config.php Above the Webroot

WordPress automatically looks for wp-config.php one directory up. Moving it there means an attacker who exploits a path traversal flaw cannot easily reach your most sensitive configuration file.

5. Set Correct File Permissions

Directories at 755, files at 644, and wp-config.php at 600. Never use 777 on anything, as it grants world-write access and is a malware foothold waiting to happen.

6. Use a Web Application Firewall

A firewall blocks the most common exploit patterns before they reach your server. Combined with a plugin-level firewall, you get two layers of protection, as explained in our guide on the web application firewall.

7. Keep PHP Current

Old PHP versions no longer receive security patches. Running a current version improves both security and performance. Test in staging first, since some older plugins lag behind. Our guide on your PHP version covers this.

8. Disable the File Editor in wp-admin

Disabling the dashboard file editor means that even if an attacker gains admin access, they cannot inject malicious code directly through the interface.

9. Monitor for File Changes

A file integrity monitor alerts you when core WordPress files change unexpectedly, a reliable indicator of compromise. Configure alerts to reach an email you actually check.

10. Run Regular, Automated Malware Scans

Daily automated scans with alerts beat manual quarterly checks. Malware often sits dormant for weeks before activating, so the sooner you catch it, the simpler the cleanup. Our guide on malware removal covers what to do if you find something.

Hardening Is Ongoing, Not One-Time

Security is not a project you finish. New vulnerabilities appear constantly, and a site that was hardened last year can drift out of date as plugins, themes, and configurations change.

Reviewing your hardening measures as part of regular maintenance keeps them effective. The goal is layered, up-to-date defence rather than a single one-off effort.

Frequently Asked Questions

Is a security plugin enough to protect WordPress?

No. A plugin adds valuable detection and filtering, but real security comes from layers: hardening, strong logins, updates, a firewall, and backups working together.

What is the most important WordPress hardening step?

Strong passwords with two-factor authentication and prompt updates prevent the majority of real-world attacks. If you do nothing else, do those.

Will hardening break my site?

Done carefully and tested in staging, hardening should not break anything. A few steps, such as updating PHP, need testing first because older plugins may not support newer versions.

How often should I review my security setup?

Review it as part of regular maintenance, at least monthly for scans and updates, and quarterly for a fuller audit of accounts, permissions, and configuration.

Harden Your Site Properly

Real WordPress security lives in the layers beneath the plugin. These ten steps close the weaknesses that automated attacks rely on and give your site a genuinely strong foundation.

For further reading, the official WordPress hardening documentation offers helpful, authoritative guidance.

BlueBotts hardens and monitors client sites as part of every maintenance plan. Request a free site audit or contact our team to secure your site properly.