WordPress Security Hardening: Complete Protection Guide 2026

WordPress powers over 43% of all websites on the internet, making it the prime target for hackers and automated bots. In 2026, attack volumes continue to rise — but the good news is that most successful hacks exploit preventable weaknesses. This guide walks you through every important WordPress security hardening step, from beginner basics to advanced configurations.

Why WordPress Is a Top Hacker Target

Understanding the attack surface helps you prioritize defenses:

• Market dominance: 835+ million sites run WordPress — bots scan predictable URLs continuously
• Plugin and theme vulnerabilities: Tens of thousands of plugins exist; many are unmaintained or have known exploits
• Insecure defaults: Default "admin" username, predictable login URLs, no rate limiting out of the box
• Outdated software: Unpatched WordPress Core, plugins, and themes are the #1 entry point

Securing the Login Page

The login page is the most attacked entry point. Here is what to do:

1. Rename the "admin" Username

WordPress does not allow direct username changes. Create a new Administrator account with a different username, log in with it, then delete the original "admin" account:

1. Go to Users > Add New
2. Set a unique username (not "admin")
3. Set Role to Administrator
4. Log in with the new account
5. Delete the old "admin" user

2. Enable Two-Factor Authentication (2FA)

Install a plugin such as WP 2FA, Two Factor Authentication, or Google Authenticator. Enforce it for all Administrator-role accounts — this is one of the most impactful changes you can make.

3. Limit Login Attempts

Use Limit Login Attempts Reloaded or Login LockDown to automatically block IPs after repeated failed login attempts (e.g., block after 5 failures within 5 minutes).

4. Change the Login URL

Replace the default /wp-login.php and /wp-admin with an unpredictable path using the WPS Hide Login plugin:

# Example: change to
https://yoursite.com/secure-portal-xyz

5. Use Strong Passwords

Require passwords of at least 16 characters mixing uppercase, lowercase, numbers, and symbols. Use a password manager like Bitwarden or 1Password to manage credentials securely.

Keep WordPress, Themes & Plugins Updated

Keeping software updated is the single most impactful security measure you can take:

• WordPress Core: Enable auto-updates for minor releases (security patches)
• Plugins: Review and update weekly; delete plugins you are not actively using
• Themes: Update your active theme and delete unused themes

Check for Vulnerable Plugins

Use WPScan Vulnerability Database or browse wpscan.com to look up known vulnerabilities in plugins you have installed.

Set Correct File Permissions

Incorrect file permissions can allow attackers to modify files directly. Recommended WordPress permissions:

File Type	Recommended Permission	Notes
Directories	755	Owner full, Group/Other read+execute
General Files	644	Owner read/write, Group/Other read-only
wp-config.php	600 or 640	Never 777
.htaccess	644	Web server must be able to read it

Set via DirectAdmin File Manager or SSH commands:

find /home/user/public_html -type d -exec chmod 755 {} \;
find /home/user/public_html -type f -exec chmod 644 {} \;
chmod 600 /home/user/public_html/wp-config.php

Disable Unnecessary Features

Disable XML-RPC

XML-RPC is a legacy remote publishing API that hackers exploit for brute force and DDoS amplification. Add to .htaccess:

<Files xmlrpc.php>
  Order Deny,Allow
  Deny from all
</Files>

Disable File Editing in wp-admin

Prevent theme and plugin files from being edited via the admin dashboard by adding to wp-config.php:

define('DISALLOW_FILE_EDIT', true);

Disable Directory Browsing

Add to .htaccess:

Options -Indexes

Hide WordPress Version

Add to your child theme's functions.php:

remove_action('wp_head', 'wp_generator');

Install a WAF and Security Plugin

A Web Application Firewall (WAF) filters malicious traffic before it reaches your site:

Plugin / Service	Cost	Key Features
Wordfence Security	Free / Premium ~$119/yr	WAF, Malware Scan, Login Security, 2FA
Sucuri Security	Free (Cloud WAF $199/yr)	Malware Scan, File Integrity, Activity Audit
iThemes Security	Free / Pro ~$99/yr	Brute Force Protection, 2FA, Malware Scan
All In One WP Security	Free	Firewall, Login Security, DB Security
Cloudflare	Free / Pro $25/mo	CDN + DNS-level WAF, broader coverage

Force HTTPS

SSL is not just for SEO — it encrypts all traffic between your visitors and your server:

# Add to .htaccess to force HTTPS
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Then update your WordPress URLs at Settings > General to use https://, and add to wp-config.php:

define('FORCE_SSL_ADMIN', true);

Backup Strategy

A good backup covers both files and the database, stored off-site from your server:

• UpdraftPlus: Backs up to Google Drive, Dropbox, or S3 automatically — most popular choice
• BackupBuddy: Premium plugin with easy one-click restore
• Duplicator: Great for both migration and backup

AsiaGB Hosting includes twice-monthly automated backups (1st and 15th of each month), stored for one cycle. We recommend setting up UpdraftPlus for additional daily or weekly backups to your own cloud storage.

Harden wp-config.php

wp-config.php holds your database credentials and security keys — protect it carefully:

Regenerate Security Keys and Salts

Visit https://api.wordpress.org/secret-key/1.1/salt/ to generate new keys, then replace the existing ones in wp-config.php.

Move wp-config.php Above the Public Root

WordPress supports placing wp-config.php one directory above the document root:

/home/user/
  wp-config.php   ← move here
  public_html/
    index.php
    wp-admin/
    ...

Additional Security Flags

// Disable debug mode in production
define('WP_DEBUG', false);

// Prevent file edits from wp-admin
define('DISALLOW_FILE_EDIT', true);

// Force SSL for admin
define('FORCE_SSL_ADMIN', true);

Monitor Your Site

Early detection minimizes damage:

• Activity Log: Use WP Activity Log to track every admin action
• Uptime Monitor: UptimeRobot or Pingdom alerts you if the site goes down
• Google Search Console: Check if Google has flagged your site as malware-infected
• Email Alerts: Configure security plugins to email you on failed login thresholds

Security Methods Comparison Table

Security Measure	Difficulty	Impact	Cost
Rename "admin" username	Easy	Reduces brute force	Free
Enable 2FA	Easy	Stops stolen-password login	Free
Limit login attempts	Easy	Blocks brute force bots	Free
Hide login URL	Easy	Reduces bot scanning	Free
Update plugins/themes	Easy	Closes known vulnerabilities	Free
Set file permissions	Medium	Prevents unauthorized file edits	Free
Disable XML-RPC	Easy	Closes legacy attack vector	Free
WAF plugin	Easy	Filters malicious traffic	Free–$199/yr
Force HTTPS	Easy	Encrypts all traffic	Free (Let's Encrypt)
Harden wp-config.php	Medium	Protects critical credentials	Free
Automated backups	Easy	Recovery after an attack	Free–$50/yr
Cloudflare WAF	Medium	DNS-level protection	Free–$25/mo

Frequently Asked Questions

Summary: Harden WordPress Today

Most WordPress sites can be protected against 90%+ of attacks by implementing just five basic measures:

1. Rename the "admin" account and use a strong password
2. Enable 2FA for all administrator accounts
3. Limit login attempts
4. Keep WordPress, plugins, and themes updated
5. Install Wordfence Security