WordPress Security Hardening Checklist, Ordered by Impact
Built for UAE websites that need monthly care, safer updates, and a clearer support routine after launch.
Short Answer
Harden WordPress by securing logins with two-factor authentication, cutting and updating plugins, disabling the file editor, fixing file permissions and keeping clean off-site backups.
WordPress is so widely used that automated attackers study it more closely than almost any other platform. The core software itself is maintained carefully and patched quickly by its security team. The weak points are nearly always around it: stale plugins, weak admin passwords and settings left at their defaults. Most of those can be fixed in a single afternoon.
This checklist follows the official Hardening WordPress guidance from WordPress.org, ordered by how much risk each step removes for a typical business site. It assumes you or your developer can reach the dashboard, hosting panel and wp-config.php file. Each section explains the setting and the reason behind it in plain language. Start at the top and work down in order.
How do you lock down the WordPress login?
Give every user a unique account with the lowest role that fits their work, and delete the default admin username if it still exists. Enforce strong passwords and turn on two-step authentication for all administrators. WordPress.org's official hardening guide recommends both measures for every site.
Limit repeated login attempts through your firewall or a reputable security plugin, since brute-force bots hit wp-login.php constantly. Review user accounts every quarter and remove anyone who has left the business. Application passwords, available since WordPress 5.6, should be revoked when an integration is retired.
Quick Answer
Lock down WordPress logins with unique accounts, minimum roles, strong passwords and two-step authentication for all administrators. Limit login attempts and promptly remove departed users and any unused application passwords.
Why are plugins the biggest WordPress risk?
Plugins and themes add code written by many different developers, and each one can contain a vulnerability. Install only from the WordPress.org directory or well-known vendors, as the official guidance advises. Delete deactivated plugins rather than leaving them installed, because inactive code can still be reached.
Update plugins, themes and core promptly, ideally after a quick test on staging. WordPress has applied automatic minor core updates since version 3.7, but plugin updates still need attention. Replace any plugin whose author has stopped releasing updates, even if it appears to work.
Quick Answer
Plugins are the biggest WordPress risk because each one adds third-party code. Install from trusted sources only, delete unused plugins, update promptly and replace abandoned ones before attackers exploit them.
Which wp-config.php settings should you change?
Add define DISALLOWFILEEDIT as true in wp-config.php to remove the built-in theme and plugin editor. WordPress.org notes this editor is often the first tool an attacker uses after logging in, because it allows code execution. Most business sites never need that editor, since changes belong on staging.
Protect wp-config.php itself by restricting its permissions, commonly to 400 or 440, and blocking web access to it. The guide also suggests changing the default wp_ database table prefix on new installations. Keep secret keys unique, and regenerate them after any suspected compromise.
Quick Answer
In wp-config.php, set DISALLOWFILEEDIT to true, restrict the file's permissions to 400 or 440, and keep unique secret keys. Regenerate those keys immediately after any suspected compromise or staff departure.
How should file permissions and XML-RPC be set?
WordPress.org recommends 755 for directories and 644 for files, so only your account can write to core folders. The wp-content folder needs to be writable by the web server for uploads. Block PHP execution inside the uploads folder, where attackers often try to plant scripts.
XML-RPC is an older remote interface that brute-force bots often target. Disable it if nothing uses it, but check first, because the Jetpack plugin and some mobile publishing tools rely on it. Add security headers and HTTPS across the whole site at the same time.
Quick Answer
Set WordPress directories to 755 and files to 644, block PHP execution in uploads, and disable XML-RPC when no plugin or app depends on it. Serve every page over HTTPS.
Do you still need a firewall and backups after hardening?
Yes, because hardening reduces risk but never removes it completely. A web application firewall, at the host, CDN or plugin level, filters many known attacks before they reach WordPress. It buys valuable time between a plugin vulnerability going public and your update.
Backups are the final safety net when everything else fails. Keep daily copies of files and database away from the server, retain several weeks, and test a full restore on staging regularly. WordPress.org advises regular snapshots, because a compromise can stay unnoticed for weeks before anyone spots it.
Quick Answer
Hardened WordPress sites still need a web application firewall and off-site backups. Keep several weeks of daily copies and test restores regularly, since compromises can go unnoticed for many weeks.
Main Takeaways
Most WordPress compromises come through logins, plugins and default settings rather than core software. Enforce two-step authentication and minimum user roles, delete unused plugins and update everything promptly. Set DISALLOWFILEEDIT, restrict wp-config.php and use 755 and 644 permissions for directories and files. Add a web application firewall and keep tested off-site backups, because hardening reduces risk without removing it entirely.
Keeping a hardened WordPress site hardened
Hardening is a snapshot in time, and every new plugin, user or update can quietly undo part of it. The sites that stay safe treat this checklist as a monthly routine. Someone owns it, and someone checks it against the live site. That habit matters more than any single setting on the list.
For controls beyond WordPress itself, our website security checklist for UAE businesses covers access, data and incident response. If the site is also slow, weigh the options in our guide to rebuilding a slow WordPress site. Auronix Web Studio's WordPress maintenance and support plans cover core, theme and plugin updates, backups and security monitoring. Book the first review for the same week you install your next plugin.
Sources & References
FAQs
Questions readers usually ask next
These FAQs are written to match the topic of this post and to help readers move from understanding to action.
What is the single most important WordPress security step?
Securing administrator logins with strong unique passwords and two-step authentication removes a very common entry route. Keeping every plugin and theme updated comes a close second on most business sites.
Should I disable XML-RPC on my WordPress site?
Disable it if no plugin, app or integration uses it, because bots target it for password guessing. Check Jetpack and mobile publishing tools first, since they may depend on it.
Does a security plugin replace manual hardening?
No, a security plugin adds scanning and login protection but cannot fix weak roles, abandoned plugins or bad file permissions. Use it alongside the hardening steps, not instead of them.
Is managed WordPress hosting more secure than shared hosting?
Managed hosts often add server firewalls, malware scanning and automatic core updates, which reduces risk. You still control users, plugins and themes, so hardening remains your responsibility on any plan.
How do I know if my WordPress site has been hacked?
Warning signs include unknown admin users, unexpected redirects, spam pages in Google results and unfamiliar files. Google Search Console may also show a security issues message for your verified property.
Should WordPress plugins update automatically?
Automatic updates suit well-maintained plugins on simpler sites where speed of patching matters most. Complex stores should test updates on staging first, because a broken checkout also costs real money.
Is changing the wp-admin login URL worth doing?
It reduces automated login noise but is not real protection, since determined attackers can find it. Treat it as optional, and prioritise two-step authentication and strict login rate limiting first.
Which user role should content editors have in WordPress?
Give content staff the Editor or Author role, never Administrator. Only people who install plugins or change settings need administrator access, and there should only be very few of them.
How often should a WordPress site be security checked?
Check updates weekly, review users and plugins monthly, and run a fuller hardening review each quarter. Repeat the fuller review after any redesign, major new plugin or suspected security incident.
Can a nulled premium plugin cause a security problem?
Yes, nulled plugins are pirated copies that frequently contain hidden backdoors or malware. They also receive no official security updates, so use only licensed copies bought from the original developer.
Related Resources
Need a maintenance partner after launch?
We help UAE businesses keep forms, updates, backups, speed, SEO, and tracking under control so the site stays useful and easy to trust.
Built for WordPress, Shopify, and custom sites that need monthly care or AMC support.
