One Login Away From Disaster: A WordPress Security Hardening Guide

Most WordPress sites don’t get hacked by a shadowy genius picking your lock. They get hacked by a bot that tried a million common passwords, or by an outdated plugin with a hole that was patched three months ago and never updated. The attacker never even looked at your business. Your site was just an address on a list.

That’s just what running WordPress looks like: the same popularity that hands you endless plugins and themes also keeps you on the target list for automated attacks. The upside is that most of the defenses are boring and cheap, and you set them once. You’re not outsmarting a hacker here. You’re closing the doors they already know how to walk through.

What follows is a practical WordPress security hardening checklist you can work through in an afternoon. No fear-mongering, no snake oil, just the layers that stop the attacks that actually happen, ordered so the highest-impact steps come first.

Why WordPress Sites Actually Get Hacked

Before you install a single security plugin, it helps to understand what you’re defending against. The last WordPress cleanup we did looked like this: an attacker’s bot had planted an IndoXploit webshell on the site and was quietly using it to serve spam for someone else. Nobody had singled out the business; the site was just an unpatched address on a list. That’s the norm. Attacks on WordPress are overwhelmingly automated and opportunistic, with bots crawling the web for known weaknesses and exploiting them at scale the moment they find one. Knowing where the holes actually are tells you where to spend your effort.

It’s Almost Never WordPress Core

WordPress core is one of the most scrutinized codebases on the internet. A dedicated security team maintains it, serious flaws get patched fast, and automatic background updates for security releases ship on by default. The core software is rarely the way in. In its State of WordPress Security in 2024 report, security firm Patchstack found that 97% of new vulnerabilities were in plugins and 3% in themes, with just 0.2% in WordPress core itself. The weak point is almost never WordPress, it’s the code you bolt on top of it.

The Real Entry Points

Four doors account for most break-ins. Nearly every compromise traces back to one of them, which is exactly why the checklist below goes straight at them:

• Weak or reused login credentials guessed by brute-force bots hammering wp-login.php
• Outdated plugins and themes with a publicly known vulnerability the owner never patched
• Abandoned or nulled plugins (pirated premium plugins are a notorious malware vector)
• Over-privileged users and shared admin accounts that turn one mistake into a full takeover

Sophisticated zero-day exploits aren’t on that list, and that’s the point. They exist, but they’re not what takes down the average small-business site. The boring stuff is what gets you, and boring problems are cheap to fix.

The WordPress Security Hardening Checklist

Here’s the full stack, ordered by impact. You don’t need every item on day one, but the first three stop the vast majority of real-world attacks, so start there.

1. Strong Logins and Two-Factor Authentication

This is the single highest-leverage change you can make. Brute-force and credential-stuffing bots are the number-one attack against WordPress, and they only work against weak or reused passwords. Fix that, and a whole category of attack just stops working.

• Use a long, unique passphrase for every admin account, generated and stored in a password manager. Length beats complexity.
• Turn on two-factor authentication (2FA) for every user who can log in. Even a stolen password is useless without the second factor. Free plugins like WP 2FA or Two-Factor add this in minutes.
• Limit login attempts so a bot gets locked out after a handful of failures instead of guessing forever. Many firewall plugins include this.
• Never use “admin” as a username. It’s the first thing every bot tries, so you’d be handing over half the credential for free.

2. Keep Everything Updated (This Is Not Optional)

An outdated plugin is an open invitation, and it’s the most common way sites get popped. When a vulnerability is disclosed and patched, the patch itself tells attackers exactly what to exploit on every site that hasn’t updated yet. The window between “patch released” and “bots scanning for the unpatched” is measured in hours, not weeks.

• Update core, plugins, and themes promptly. Enable automatic updates for anything you trust to update cleanly.
• Delete what you don’t use. A deactivated plugin still sits on your server and can still be exploited. If it’s not active, remove it entirely.
• Only install from reputable sources: the official WordPress.org directory or a developer you trust. Never run “nulled” (pirated) premium plugins, which are a classic malware delivery method.
• For business-critical sites, test major updates on a staging copy first so a bad update never breaks production.

3. Least-Privilege User Roles

Not everyone needs to be an Administrator, and most of the people who have it don’t. WordPress ships with roles for a reason: a writer needs Author or Contributor, an editor needs Editor, and only the one or two people who genuinely run the site need Administrator. The fewer admin accounts you have, the smaller your attack surface.

• Audit your Users screen and downgrade anyone who has more access than their job requires.
• Remove accounts for people who have left. Dormant admin accounts are a favorite target.
• Give each person their own account. Shared logins make it impossible to know who did what.

4. Lock Down the Files

A handful of small changes make WordPress much harder to tamper with. These live in your wp-config.php file and your server configuration, and the official Hardening WordPress guide documents them in full.

• Disable the built-in file editor. Add define('DISALLOW_FILE_EDIT', true); to wp-config.php so that even if an admin account is compromised, an attacker can’t edit your theme and plugin code straight from the dashboard.
• Set correct file permissions. WordPress recommends 644 for files and 755 for directories. Never use 777 on anything.
• Protect wp-config.php. It holds your database credentials and secret keys. Keep it out of any public backup and, where your host allows, move it or block direct web access to it.
• Rotate your security keys (the authentication salts in wp-config.php) if you ever suspect a compromise. It forces every logged-in session to re-authenticate.

5. A Firewall and Malware Scanning

A web application firewall (WAF) filters malicious traffic before it reaches WordPress. It blocks known bad requests, throttles brute-force attempts, and shields you from newly disclosed vulnerabilities before you’ve had the chance to patch. Pair it with regular malware scanning that inspects your files for injected code, so you catch a compromise early instead of hearing about it from Google.

You can run a WAF at the plugin level, at your host, or at the DNS/CDN edge with a service like Cloudflare. Any of them beats none. The scanner won’t stop an attack on its own, but it’ll flag one the moment something slips through.

Backups: Your Last Line of Defense

Sooner or later, assume something gets through. No stack is perfect, and the one thing that separates a minor inconvenience from a genuine catastrophe is whether you can restore a clean copy of your site. When a cleanup does happen, a recent off-site backup is the difference between rolling back in minutes and rebuilding by hand for days.

What a Good Backup Looks Like

• Automatic and scheduled so you never have to remember to run one. Match the frequency to how often your site changes.
• Off-site. A backup stored on the same server that gets compromised is no backup at all. Send copies to separate cloud storage.
• Complete: both your files and your database. One without the other can’t rebuild the site.
• Tested. Run a test restore at least once so you know it actually works before the day you’re counting on it. Plenty of backups turn out corrupt or incomplete only when someone finally tries to use one.

The widely cited 3-2-1 rule is a good target: three copies of your data, on two different types of media, with one copy off-site. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) spells out this same 3-2-1 rule in its Data Backup Options guidance as a core defense against ransomware and data loss.

How to Tell If You’ve Already Been Hacked

Compromises aren’t always obvious. The stealthier ones hide, quietly using your site to send spam, host phishing pages, or inject links that boost someone else’s rankings. Watch for these warning signs:

• Google Search Console sends a security issue notification, or your site shows a “deceptive site” warning in browsers.
• Unexpected new admin users appear that you didn’t create.
• Your homepage redirects somewhere else, especially on mobile or when arriving from a search engine.
• Search results for your site show pages or keywords you never published (often pharma, gambling, or counterfeit-goods spam).
• Your host emails about unusual resource usage or outbound spam from your account.

If you spot any of these, take the site offline, restore from a known-clean backup, rotate every password and security key, update everything, and only then bring it back. Catch it early and you’re looking at a quick restore instead of a full rebuild.

Where amplifi.plugins Fits In

Hardening is a checklist, and checklists are easy to drift away from. That’s where a maintained WordPress suite earns its keep. amplifi.plugins is the open-source, AI-powered suite from amplifi.studio, bundling security scanning alongside schema, SEO meta, translation, alt text, and more, all under a single “amplifi.studio” sidebar menu with one install and one update to keep it current. You turn on only the features you need.

Because the whole suite updates as one, you close one of the biggest gaps on this entire list, the outdated half-maintained plugin, more or less by design. Fewer separate plugins to track means fewer things to forget to update. It’s the same idea running through this whole checklist. The less you run, the less there is to keep patched, and you can hand most of that upkeep to something that won’t forget it.

Frequently Asked Questions

Security isn’t a product you buy once, it’s a habit you keep. Work down this checklist, automate what you can, and let a maintained, open-source suite carry the parts humans forget.

Built by amplifi.studio — see also The Slow-Site Tax: how to fix WordPress Core Web Vitals.