WordPress core has a dedicated security team and a strong track record of fast fixes. Most WordPress compromises do not come from core at all. They come from outdated plugins, weak or reused passwords, abandoned admin accounts and hosting that was never locked down. The good news is that these risks are well understood and preventable.
This is the hardening checklist we apply to every site we build or take over, from small municipalities to large publishers.
Updates are the foundation
Most successful attacks exploit known vulnerabilities that already have a patch. Keeping core, plugins and themes updated is the single most effective security measure. But updates on production without testing cause their own outages, so we:
- Apply core minor releases automatically, since they are mostly security and bug fixes
- Test plugin and major core updates on staging first, then deploy through Git
- Monitor vulnerability feeds daily for every plugin on every site we manage
- Remove plugins and themes that are inactive or abandoned by their authors
Lock down accounts
People are the most common way in. We enforce:
- Two factor authentication for every administrator and editor
- Unique, strong passwords through a password manager
- Single sign on with your identity provider where possible, so departures are handled centrally
- Least privilege roles; most people do not need to be administrators
- Quarterly reviews to remove accounts that are no longer needed
- Login rate limiting and blocking of common brute force patterns
Harden the application
A few configuration changes close common doors:
- Disable file editing in the dashboard with DISALLOW_FILE_EDIT
- Keep wp-config.php outside the web root or protected, with unique salts
- Set correct file permissions so the web server cannot write to code directories
- Disable XML-RPC if nothing uses it
- Restrict the REST API user listing endpoint where usernames should not be exposed
- Send security headers such as Content Security Policy, HSTS and X-Content-Type-Options
Protect the edge
A web application firewall at the CDN or host blocks malicious traffic before it reaches WordPress. We also enable bot management, DDoS protection and rate limits on login and form endpoints. This keeps attack traffic from consuming server resources and is especially important for public sector sites that see constant automated scanning.
Custom code security
Every custom plugin and theme we write follows the WordPress security APIs: escape output, sanitize input, verify nonces, check capabilities and prepare SQL. We run static analysis in CI and review every pull request with a security checklist. Third party code gets reviewed before it is installed, not after something goes wrong.
Backups you have actually restored
Backups only count if you can restore them. We keep automated daily backups of files and database, stored off site, with retention that fits your needs, and we test restores on a schedule. For high change sites we add more frequent database backups.
Logging, monitoring and response
You cannot respond to what you cannot see. We log administrator activity, file changes and failed logins, monitor uptime and file integrity, and alert a person when something looks wrong. A written incident response plan lists who to call, how to isolate the site, how to restore and how to communicate. When a site is compromised, speed and calm matter more than anything else.
Hosting matters
Security is shared between the application and the server. Isolated containers, current PHP, automatic OS patching, encrypted connections and restricted SSH or SFTP access are table stakes. Our managed hosting guide explains what to expect.
Security for editors, not just developers
Many incidents start with a person, not a server. An editor reuses a password, clicks a convincing phishing email or shares a login with a contractor. We give every client a short security guide for their content team: use the password manager, never share accounts, approve the two factor prompt only when you are logging in, and report anything unusual right away. We also make the safe path the easy one, with single sign on so there are fewer passwords to manage and roles that give contractors only what they need for as long as they need it. A well trained editorial team is one of the most effective security controls a WordPress site can have, and it costs almost nothing to put in place.
Security hardening checklist
- Tested update process with daily vulnerability monitoring
- Two factor authentication and least privilege roles
- Dashboard file editing disabled and permissions locked down
- Security headers and XML-RPC reviewed
- Web application firewall and rate limiting at the edge
- Secure coding standards and code review for custom work
- Off site backups with tested restores
- Activity logging, monitoring and a written incident plan
Frequently asked questions
Is WordPress secure enough for government and enterprise?
Yes. Governments, universities and global brands run WordPress. Security depends on how it is configured, maintained and hosted.
Do security plugins replace hardening?
No. They help with scanning and login protection, but the core of security is updates, accounts, server configuration and monitoring.
Can you clean up a hacked site?
Yes. We isolate the site, remove malicious code, close the entry point, rotate credentials and harden it so it does not happen again.
Want a second opinion on your site? Start with a WordPress site audit or see our security and hosting services.
