WordPress security: how to protect your site from hacking
PrintMost WordPress sites are not broken into through WordPress itself but through an outdated plugin or theme, a weak password, or a password stolen from an infected computer. The good news is that a handful of habits close almost all of these doors. This guide starts with what every site owner should do, then covers the ready-made protections in WP Toolkit, and ends with manual settings for those comfortable editing files.
What the server already does, and what is up to you
On TopHost hosting, Imunify360 scans the accounts for malicious files and filters attacks, the server firewall blocks IP addresses that keep guessing passwords, and JetBackup 5 takes automatic copies kept on a 30-day rotation. None of this can keep a vulnerable plugin safe. Under the Terms and Conditions, choosing plugins and themes carefully and keeping them updated is the client's responsibility. More about the server side: Imunify360 on TopHost hosting and why the firewall blocks an IP address.
The basics: do these on every site
1. Keep everything updated
Bots scan the internet for known flaws within hours of their publication. Update WordPress, plugins and themes from cPanel: open WP Toolkit (WordPress Management), check which items have updates waiting and apply them. WP Toolkit can also install updates automatically. The WordPress dashboard (Dashboard, then Updates) does the same job if you prefer it, or if WP Toolkit does not appear in your cPanel. Before a large update, take a copy; the routine is described in a safe routine for WordPress updates.
2. Remove what you do not use
A deactivated plugin still sits on the server, and its files can still be attacked. Delete unused plugins and themes; keep only one default theme as a spare.
3. Install only from trusted sources
Use the official catalogue at wordpress.org or the developer's own site. "Free" copies of paid themes and plugins found elsewhere often contain hidden code that gives an outsider access.
4. Strong logins
- Do not use "admin" as a username. Create a new administrator with a different name, sign in with it, then delete the old account and assign its content to the new one.
- Use long, unique passwords (at least 12 to 15 characters) stored in a password manager. Never reuse the password of your e-mail or another site.
- Turn on two-factor authentication for WordPress with a security plugin, and for the client area and cPanel as described in two-factor authentication.
- Limit repeated login attempts. Popular plugins that do this include Limit Login Attempts Reloaded, Wordfence Security and All-In-One Security (AIOS). One security plugin is enough; two of them often get in each other's way.
5. Keep your own copy
Automatic backups are a safety net, not an archive. Download a full copy of the account from time to time and keep it off the hosting: how to download a full account backup.
Ready-made protections in WP Toolkit
- In cPanel, open WP Toolkit (WordPress Management) and choose your site.
- Open the Security section of the site. WP Toolkit lists protection measures and marks which ones are already applied.
- Apply the recommended measures. Typical examples are disabling file editing from the WordPress dashboard, blocking access to sensitive files, forbidding PHP execution in folders that should only hold uploads, and blocking access to xmlrpc.php.
- Open the site and its admin area afterwards. If something stops working (for example a mobile app or a service that uses xmlrpc.php), revert that single measure from the same screen.
WP Toolkit can also check whether the WordPress core files match the originals; see checking and reinstalling the WordPress core.
Manual settings for advanced users
Save a copy of each file before you edit it. The lines below go into the files with the File Manager in cPanel or over FTP.
Turn off the built-in code editor
Add this line to wp-config.php, above the line that says "That's all, stop editing". Even if someone gets into the dashboard, they cannot change theme or plugin code from there:
define( 'DISALLOW_FILE_EDIT', true );
Deny direct access to wp-config.php and xmlrpc.php
Add to the .htaccess file in the site's root folder. Leave out the xmlrpc.php block if you use the WordPress mobile app, Jetpack or another service that publishes through XML-RPC:
<Files "wp-config.php">
Require all denied
</Files>
<Files "xmlrpc.php">
Require all denied
</Files>
Allow the login page only from your IP address
This suits sites with one or two administrators who work from a fixed IP address. Do not use it if customers, authors or a shop's buyers sign in from anywhere, or if your provider changes your IP address. Replace 203.0.113.10 with your own address; add one more Require ip line for each extra address. In the root .htaccess:
<Files "wp-login.php">
Require ip 203.0.113.10
</Files>
To close the whole admin area, create a .htaccess file inside the wp-admin folder. The second block keeps admin-ajax.php open, because themes and plugins use it for visitors too and the site breaks without it:
Require ip 203.0.113.10
<Files "admin-ajax.php">
Require all granted
</Files>
If you lock yourself out (for example after your IP address changes), edit or delete these lines from the File Manager in cPanel.
File permissions
Folders should be 755 and files 644. Never set 777: it lets any process write to the file. Permissions can be changed in File Manager with Permissions.
Table prefix
Choosing a prefix other than wp_ makes automated attacks slightly harder. Set it when you install WordPress (WP Toolkit and Softaculous let you choose it). Changing it on a working site takes care and brings little, so we do not recommend doing it just for this.
If the site has already been hacked
- First steps in the right order: your website has been hacked.
- Received a notice about infected files: what to do within 24 hours.
- A plugin or theme you use has a published security flaw: the steps to take.
- To restore a clean copy from before the attack: restoring with JetBackup 5.
Need help? Open a support ticket with the site address and what you noticed.
