WordPress Security 2025: The Full Hardening Checklist

WordPress is attacked automatically. Bots scan wp-login.php, xmlrpc.php and known vulnerabilities around the clock. Here is the minimum checklist.

1. Updates come first

Around 75% of compromises come through outdated themes and plugins. Enable auto-updates or check weekly.

2. Protect wp-admin

# In .htaccess or Nginx:
location /wp-admin {
    allow 1.2.3.4; # your IP
    deny all;
}

3. Disable xmlrpc.php

location = /xmlrpc.php {
    deny all;
}

4. Change the login URL

Use WPS Hide Login. Instead of /wp-login.php → /your-secret-page.

5. Two-factor authentication

WP 2FA or Google Authenticator. Mandatory for administrator accounts.

6. File permissions

find /wp-content -type f -exec chmod 644 {} \;
find /wp-content -type d -exec chmod 755 {} \;
chmod 600 wp-config.php

7. Security headers

add_header X-Content-Type-Options "nosniff";
add_header X-Frame-Options "SAMEORIGIN";
add_header Strict-Transport-Security "max-age=31536000";

8. Wordfence or Sucuri

Install one of them. Wordfence is free and sufficient for most sites.

Want an audit? Order a WordPress security audit.