A WordPress Hardening Checklist That Actually Holds

WordPress powers over 40% of the web, which makes it the most-scanned attack surface in existence. Every mass-exploitation campaign starts by sweeping for it. The good news: the attacks are overwhelmingly automated and unimaginative, which means disciplined configuration defeats most of them outright.

Start with what runs: core and plugins updated on a schedule measured in days, and — more important — fewer plugins. Every plugin is third-party code with your database privileges. If it isn't earning its place, it's pure attack surface. Audit the list quarterly and delete, don't just deactivate.

Then, who gets in: unique admin usernames, strong passwords enforced, two-factor authentication on every account that can publish or configure, and login endpoints rate-limited. Disable XML-RPC unless something genuinely needs it, and turn off the built-in file editor — a compromised admin session should not come with a code editor attached.

Finally, assume something eventually slips through: file-integrity monitoring so changes are seen, off-site backups that are tested by restoring them, and least-privilege database credentials so a compromised site can't become a compromised server. Hardening isn't one heroic afternoon — it's a configuration that stays held because updates, audits, and monitoring run without anyone remembering to do them.