WordPress Security Hardening

Protecting WordPress against common attacks

WordPress is attacked constantly — not deliberately, but as background noise: scanners work through known plugin vulnerabilities and weak passwords across millions of sites every day. This service closes the standard scenarios used in around 90% of cases.

What I configure

• Access: login attempt limits, two-factor authentication, changing the default login URL.
• File permissions and disabling code editing from the admin.
• PHP execution in the uploads directory — the most common place a web shell gets dropped.
• Hiding utility information: versions, user enumeration, access to service files.
• Security headers at web server level.
• Plugin review: removing abandoned and pirated ones — they are the most frequent carriers of backdoors.
• Updates, with automatic installation configured for critical fixes.

What this does not do

It does not make the site invulnerable — no such guarantee exists. Hardening removes the mass automated scenarios; it will not save you from a targeted attack using an unknown vulnerability. Which is why it should always be paired with backups.

Important before we start

If the site is already behaving oddly — redirects, unknown pages in search, visitor complaints — it needs cleaning first. Hardening the perimeter does not remove a backdoor that is already inside; it only makes that backdoor harder to find.