WordPress is the most popular CMS globally, making it a frequent target for automated vulnerability scans and hacking attempts. Securing a WordPress installation requires a multi-layered approach that includes configuring secure file permissions, locking down administrative portals, and using Web Application Firewalls (WAF). In this guide, we will discuss WordPress security hardening best practices to protect your site.
Many security incidents occur due to outdated plugins, weak credentials, or insecure directory configurations. Implementing key hardening techniques helps reduce your attack surface and protect your website files and database from unauthorized access.
1. File and Folder Permissions Hardening
Securing your file permissions is a fundamental step in hardening WordPress. Correct permissions restrict which system users and processes can read, write, or execute files on your web server.
Set folder permissions to 755 and file permissions to 644. Essential configuration files (like wp-config.php, which contains database credentials and security keys) should be restricted to 400 or 440, preventing other server processes from reading them. Additionally, block script execution in your uploads directory by adding the following rule to a .htaccess file inside the 'wp-content/uploads/' folder:
<FilesMatch "\.(php|phtml|php3|php4|php5|phps|pl|py|jsp|asp|sh|cgi)$">
Order deny,allow
Deny from all
</FilesMatch>2. Disabling XML-RPC and Restricting the REST API
The WordPress XML-RPC file (xmlrpc.php) enables remote connections for external applications. However, it is frequently targeted by hackers conducting brute-force login attempts and amplification DDoS attacks. Since modern applications utilize the WordPress REST API for remote connectivity, XML-RPC is largely obsolete.
Disable XML-RPC by adding a redirect or block rule in your root .htaccess file, preventing unauthorized requests from reaching the script. You can also restrict REST API access to authenticated users to prevent scrapers from harvesting user names and system information from your API endpoints.
3. Login Page Protection and Security Headers
Brute-force attacks target the standard login page (wp-login.php) by trying thousands of password combinations automatically. Protect your login portal by changing the default login URL to a custom path (e.g., /my-secure-login) using a helper plugin or rewrite rules.
Additionally, configure your web server to return security HTTP headers, helping protect visitors from cross-site scripting (XSS), clickjacking, and code injection attacks:
- X-Frame-Options: Set to
SAMEORIGINto prevent your site from being loaded inside an iframe on malicious domains. - X-Content-Type-Options: Set to
nosniffto prevent browsers from executing files that do not match their declared MIME types. - Referrer-Policy: Set to
strict-origin-when-cross-originto control how much referrer information is sent to external sites.
| Threat Vector | Hardening Strategy | Resulting Benefit |
|---|---|---|
| Brute-Force Logins | Hide wp-login.php & enforce 2FA | Prevents automated login attempts |
| Directory File Injection | Disable execution in uploads folder | Blocks uploaded malware from running |
| Credential Theft | Set wp-config.php permission to 400 | Prevents other server users from reading DB info |
| XSS & Clickjacking | Enable Security Headers in .htaccess | Protects user browser sessions |
Frequently Asked Questions (FAQ)
Why is WordPress targeted so frequently by hackers?
Because WordPress powers over 40% of all websites globally. Its large market share makes it a prime target for automated botnets that scan millions of sites for known plugin vulnerabilities and weak login credentials.
How does Clytrix protect my site from malware?
Clytrix hosting includes Imunify360, a security suite that provides real-time malware scanning, a Web Application Firewall (WAF), intrusion detection, and automated cleanup to protect against vulnerabilities.
Should I disable the WordPress theme and plugin editor?
Yes. Disabling the built-in file editor (by adding define('DISALLOW_FILE_EDIT', true); to wp-config.php) is a security best practice. If an administrator account is compromised, this prevents attackers from editing theme files to inject malicious code.