WordPress is attacked automatically. Bots scan wp-login.php, xmlrpc.php and known vulnerabilities around the clock. Here is the minimum checklist.
1. Updates come first
Around 75% of compromises come through outdated themes and plugins. Enable auto-updates or check weekly.
2. Protect wp-admin
# In .htaccess or Nginx:
location /wp-admin {
allow 1.2.3.4; # your IP
deny all;
}
3. Disable xmlrpc.php
location = /xmlrpc.php {
deny all;
}
4. Change the login URL
Use WPS Hide Login. Instead of /wp-login.php → /your-secret-page.
5. Two-factor authentication
WP 2FA or Google Authenticator. Mandatory for administrator accounts.
6. File permissions
find /wp-content -type f -exec chmod 644 {} \;
find /wp-content -type d -exec chmod 755 {} \;
chmod 600 wp-config.php
7. Security headers
add_header X-Content-Type-Options "nosniff"; add_header X-Frame-Options "SAMEORIGIN"; add_header Strict-Transport-Security "max-age=31536000";
8. Wordfence or Sucuri
Install one of them. Wordfence is free and sufficient for most sites.
Want an audit? Order a WordPress security audit.