How to harden WordPress: a practical checklist

Why WordPress sites get attacked

Almost no attack is personal. They're automated programs sweeping the internet at random, looking for sites with an old version, a weak password or a buggy plugin. They don't care what you sell. They just care that the door is open. That's why a small, neglected site gets hit more often than a large, maintained one: it's simply easier.

Hardening WordPress doesn't mean becoming an expert: it means closing, one by one, the doors bots know by heart. We'll go from the most important to the least.

1. The basics that matter most

• Always update WordPress, theme and plugins. Most intrusions exploit already-fixed flaws on sites that never installed the update. A recent case is the wp2shell flaw.
• Long, unique passwords for every admin account, plus two-factor authentication where possible.
• Fewer plugins: each is third-party code that can contain flaws. Remove (not just deactivate) the ones you don't use.
• Automated, tested backups. Not prevention, but what saves you when prevention isn't enough.

2. Secret keys and wp-config.php

The wp-config.php file is the heart of the configuration. Inside it are the secret keys: eight random keys that strengthen cookies and tokens. If you suspect someone got in, regenerating them logs everyone out and invalidates stolen cookies. Create them with the salts generator and, if you're starting from scratch, set up the whole file with the wp-config.php generator, which already includes the recommended security options.

3. Close the unused doors

WordPress leaves on, by default, some features almost nobody uses but bots love: XML-RPC (abused for brute-force attacks), user enumeration (to discover admin account names) and the in-dashboard file editor (which turns a stolen password into full control). Closing them takes nothing away from the site. Get the ready snippet from the hardening snippets generator.

4. Server-level protection (.htaccess)

If your site runs on Apache, the .htaccess file can force HTTPS, protect sensitive files like wp-config itself, and block access to xmlrpc.php before WordPress is even involved. It's an extra barrier, in front of all the others. The .htaccess generator builds the right rules without risking syntax errors that take the site down.

What isn't enough

No «magic» plugin secures a site on its own, and no single rule does either. Security is a sum: update, use strong passwords, remove the surplus, close the unused doors. Be wary of anyone promising total protection in one click. That's usually what the bots are waiting for.

Check your site

First, check whether you're exposed to a known flaw: the WordPress vulnerability checker reads the version the site publishes and compares it with the fixed ones. It sends no attack: thirty seconds, free, no data collected. All the other WordPress tools generate code in your browser, sending nothing.