Hardening WordPress

Security in WordPress is taken very seriously, but like any other system it can be exposed if a few basic precautions are skipped. This guide walks through the common ways a WordPress site gets compromised and the practical steps you can take to harden your installation. It is not a one-click fix for every security concern. If you have doubts about your specific setup, talk them through with people you trust to know both computer security and WordPress.

Hardening matters even more when you run a network of sites. If you operate multiple WordPress installs across an SEO hosting account, one weak site can become the entry point that puts every neighbour at risk. Isolation, whether by separate databases, separate accounts, or a dedicated IP per site, is a containment measure, not a ranking trick. A dedicated Class C IP does not lift your rankings on its own; its value is defensive, keeping you off shared addresses with bad-neighbour reputation and keeping a compromise on one property from spilling into the rest.

What security actually means

Security is not about a perfectly secure system, which is usually impractical or impossible to maintain. A secure server protects the privacy, integrity, and availability of the resources under the administrator's control. Signs of a trustworthy host include:

• They will readily discuss your security concerns and the security features and processes they offer.
• They provide the most recent stable versions of all server software.
• They provide reliable methods for backup and recovery.

Decide what you need to secure by identifying the software and data that must be protected, then work through the layers below. Three ideas run through all of them:

• Limiting access: making smart choices that reduce the entry points available to an attacker.
• Containment: configuring the system so that a single compromise does the least possible damage.
• Preparation and knowledge: keeping backups and knowing the state of your install, so you can recover quickly after a problem.

Start with your own computer

Make sure the machines you use are free of spyware, malware, and viruses. No amount of server security matters if there is a keylogger on your computer. Keep your operating system and software up to date, especially your web browser, so known vulnerabilities cannot be used against you.

Keep WordPress up to date

Like most modern software, WordPress is updated regularly to close new security issues. Older versions are not maintained with security fixes, so always run the latest release. Since version 2.7, WordPress has offered automatic updates, and the Dashboard tells you when an update is available.

Always download WordPress from the official site at wordpress.org. Official releases are not distributed anywhere else, so never install it from any other website. When a vulnerability is fixed and a new version ships, the details needed to exploit the old version are effectively public, which is exactly why running an outdated install is so risky. If you manage more than one installation, version control such as Subversion can make keeping them current easier.

If you think you have found a security flaw in WordPress, report it responsibly rather than posting it publicly, and report ordinary bugs too, since a bug can sometimes lead to a vulnerability.

Passwords

Many vulnerabilities are avoided with good habits, and a strong password is central. The aim is a password that is hard to guess and hard to brute force. Password generators can produce secure strings, and WordPress shows a strength meter when you set one, so use it. When choosing a password, avoid:

• Any permutation of your real name, username, company name, or website name.
• A word from a dictionary, in any language.
• A short password.
• Anything numeric-only or alphabetic-only. A mixture of both is best.

This is not only about protecting your posts. An attacker who reaches your administrator account can install malicious scripts that may compromise the entire server.

Use SFTP, not plain FTP

When connecting to your server, use SFTP encryption if your host provides it, and if you are not sure whether they do, ask. SFTP works just like FTP except that your password and data are encrypted in transit, so they are never sent in the clear where an attacker could intercept them.

File permissions

Some WordPress features rely on files being writable by the web server, but write access is dangerous, particularly on shared hosting. Lock permissions down as tightly as you can and loosen them only where and when you genuinely need write access. As a rule, all files should be owned by your user account and writable by you, while any file WordPress itself needs to write should be group-owned by the web server's user. One workable scheme:

• / the root WordPress directory: writable only by your user account, except .htaccess if you want WordPress to generate rewrite rules automatically.
• /wp-admin/ the administration area: writable only by your user account.
• /wp-includes/ the bulk of the application logic: writable only by your user account.
• /wp-content/ user-supplied content: intended to be writable by owner, group, and public.

Inside /wp-content/ you will find:

• /wp-content/themes/ theme files: group writable only if you want to use the built-in theme editor, otherwise writable only by your user account.
• /wp-content/plugins/ plugin files: writable only by your user account.

Any other directories in /wp-content/ should be documented by the plugin or theme that requires them, and permissions may vary. When you run an automatic update, all file operations run as the user that owns the files rather than as the web server. Files are set to 0644 and directories to 0755, writable only by the owner and readable by everyone else, including the web server.

Database security

If you run several blogs on the same server, keep them in separate databases, each managed by a different user. This is easiest to set up during the initial installation. It is a containment strategy: if an intruder cracks one install, separate databases make it much harder for them to reach your other sites. If you administer MySQL yourself, understand your configuration and disable features you do not need, such as accepting remote TCP connections.

Securing wp-admin

Adding server-side password protection such as BasicAuth to /wp-admin/ puts a second layer around the admin area, the login screen, and its files, forcing an attacker or bot to break through that first. Many WordPress attacks are run automatically by malicious bots. Note that simply protecting wp-admin/ can break some functionality, such as the AJAX handler at wp-admin/admin-ajax.php, so protect the directory properly. Most attacks fall into two categories:

1. Specially crafted HTTP requests carrying exploit payloads for specific vulnerabilities, often in old or outdated plugins and software.
2. Brute-force password guessing.

Securing wp-includes

Scripts in wp-includes are generally not meant to be requested directly by any user, so you can block them with mod_rewrite in .htaccess:

• # Block the include-only files.
• RewriteEngine On
• RewriteBase /
• RewriteRule ^wp-admin/includes/ - [F,L]
• RewriteRule !^wp-includes/ - [S=3]
• RewriteRule ^wp-includes/[^/]+\.php$ - [F,L]
• RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F,L]
• RewriteRule ^wp-includes/theme-compat/ - [F,L]

Place these before the # BEGIN WordPress block.

Securing wp-config.php

You can move wp-config.php to the directory above your WordPress install. For a site installed in the root of your webspace, that means storing it outside the web root, one directory level above where wp-includes lives. Make sure only you and the web server can read it, which generally means a 400 or 440 permission.

Disable file editing

By default the Dashboard lets administrators edit PHP in plugin and theme files, and this is often the first tool an attacker reaches for once logged in, because it allows code execution. Adding this line to wp-config.php removes the edit_themes, edit_plugins, and edit_files capabilities from all users:

• define('DISALLOW_FILE_EDIT', true);

This will not stop an attacker from uploading malicious files, but it removes one common route.

Plugins

Keep every plugin updated, and delete any plugin you are not using rather than leaving it dormant. A few categories deserve extra thought:

• Firewall plugins screen out suspicious requests using rule databases or whitelists. Options include PHPIDS-based tools, the All In One WP Security and Firewall plugin, and Wordfence Security. Wordfence offers real-time visitor logs, configurable notifications, and a daily scan of your core, plugins, and themes against the official WordPress repository, with the ability to restore altered files. It does add extra database tables and can increase database size, which is a fair trade-off in the right circumstances.
• Plugins that need write access: read the code, or have someone you trust check it, before granting access to your files and directories.
• Code execution plugins: anything that runs arbitrary PHP from database entries magnifies the damage a successful attack can do. Where you can, use custom page templates that call the function instead, and note that this protection is only fully effective once you have disabled file editing within WordPress.

Security through obscurity

Obscurity is not a sound primary strategy, but a couple of measures can still help at the margins:

1. Rename the administrative account. On a new install, create a new admin account and delete the default admin. On an existing site you can rename it in the MySQL client with a statement like UPDATE wp_users SET user_login = 'newuser' WHERE user_login = 'admin';, or via a front end such as phpMyAdmin.
2. Change the table prefix. Many published SQL-injection attacks assume the default wp_ prefix, so changing it blocks at least some of them.

Backups

Back up your data regularly, including your MySQL databases. Integrity matters as much as the copy itself: encrypting backups, keeping an independent record of MD5 hashes for each file, or placing backups on read-only media all increase your confidence that the data has not been tampered with. A sound approach keeps regularly timed snapshots of the whole installation, core files and database, in a trusted location. Imagine a site that snapshots weekly: if it is compromised on 1 May but this is not spotted until 12 May, the owner still has clean pre-compromise backups to rebuild from, plus post-compromise backups that can help work out how the break-in happened.

Logging and monitoring

When you need to investigate an incident, logs are your best friend. They will not tell you which username logged in, but they will show the IP and time, and they let you spot Cross Site Scripting (XSS), Remote File Inclusion (RFI), Local File Inclusion (LFI), directory traversal, and brute-force attempts. With practice you can also see when theme and plugin editors are used and when posts, pages, and widgets change. Two open-source tools give you a layered approach:

• ModSecurity is an Apache module that acts as a Web Application Firewall, filtering and parsing traffic before it reaches your site. Configuring it for WordPress can be fiddly, and it is tailored to Apache, which still runs the large majority of web servers. An Nginx build exists but has historically been less stable.
• OSSEC runs on any Unix-like distribution and on Windows. It correlates and aggregates logs, so configure it to capture all access and error logs, account for every site on the server, and filter out the noise to make it genuinely effective.

Prevention is not always enough, and you may still be hacked, which is why intrusion detection and monitoring matter. They let you react faster, understand what happened, and recover.

I have been hacked. What now?

The Exploit Scanner plugin can help detect damage so it can be cleaned up. Beyond that:

• Change passwords for all users, especially Administrators and Editors.
• If you upload files via FTP, change your FTP password.
• Re-install the latest version of WordPress.
• Make sure all plugins and themes are up to date.
• Update your security keys.

For a fuller checklist, the official WordPress hardening documentation covers each of these areas in depth. You will find more WordPress guides in our WordPress knowledge base, and if you want a hardened, isolated environment to run several sites, our hosting plans give each site its own dedicated IP for containment and footprint control.