Secure a WordPress site

Attacks on WordPress are automated: bots try known plugin flaws and common passwords on every site they find. A few habits block almost all of them. This guide covers what to do in the WordPress dashboard and, on cPanel, with WP Toolkit.

Before you start

• Make a backup of the files and the database; see back up and restore your hosting account.
• Sign in to the dashboard with an administrator account.

Step 1: Keep WordPress, plugins and themes updated

• Install updates under Dashboard › Updates.
• Under Plugins › Installed Plugins, click Enable auto-updates for the plugins you trust to update by themselves.
• Replace plugins and themes that are no longer maintained.

Verify: Dashboard › Updates shows no pending updates.

Step 2: Protect the accounts

• Use a long, unique password for every administrator; the strength meter on the profile page should show it as strong.
• Do not use admin or webmaster as a user name.
• Add two-factor sign-in with a plugin for every administrator account.
• Under Users › All Users, remove accounts you do not know and give each person the lowest role they need (for example Editor instead of Administrator).

Step 3: Remove what you do not use

Deactivate and delete plugins you do not use, and delete themes you do not use (keep one default theme as a fallback). Install plugins and themes only from the WordPress.org directory or the vendor's own site. Never install "nulled" copies of paid plugins: they often contain malware.

Step 4: Turn off the file editor

The dashboard can edit plugin and theme files. An attacker with an administrator password could use it to add code. Turn it off in wp-config.php, above the line /* That's all, stop editing! Happy publishing. */:

define( 'DISALLOW_FILE_EDIT', true );

Verify: the Theme File Editor and Plugin File Editor entries disappear from the dashboard menus.

Step 5: Apply the hardening measures in WP Toolkit (cPanel)

1. In cPanel, open WP Toolkit (in Applications).
2. On the site's card, look at Security under Status. Fix Security means critical measures are missing; Check Security means some recommended measures are missing.
3. Click the message. In the panel that opens, select the measures you want, or the checkbox at the top of the list to select all, then click Secure.

The measures include blocking PHP in wp-includes and wp-content/uploads, blocking directory browsing, secure file permissions, renaming the admin user and turning off pingbacks. If a measure breaks something, select it and click Revert.

Step 6: Check file permissions and HTTPS

• Folders 755, files 644. Never 777.
• Use HTTPS for the whole site, including the dashboard; see turn on free SSL and force HTTPS.

Step 7: Keep backups you can restore

We back up hosting accounts weekly and monthly at no extra cost. Before large updates, also download your own copy of the files and the database, and keep a few older copies: a hack is often noticed days later.

Troubleshooting

The site breaks after WP Toolkit applied a measure. Open the security panel again, select the last measure and click Revert. Blocking PHP in wp-content can break plugins that run their own PHP files there.

You are locked out after enabling two-factor sign-in. Use the backup codes from the plugin. Without them, rename the plugin's folder in wp-content/plugins over SFTP or File Manager to turn it off, sign in, and set it up again.

You find unknown administrators, files or redirects. The site may already be compromised; see clean a hacked website.

Next steps

• If something already went wrong: fix WordPress errors.
• Speed: LiteSpeed Cache.