WordPress security hardening (practical checklist)

WordPress is secure when maintained properly. Most hacks happen because of weak passwords, outdated plugins, and missing backups.

Core steps (do these first)

• Enable automatic updates (core + plugins where safe).
• Remove unused plugins and themes.
• Use strong passwords + 2FA for admins.
• Limit login attempts and add reCAPTCHA.

Server and network layer

• Use a WAF (Web Application Firewall) if available.
• Disable XML-RPC if you don’t need it.
• Force HTTPS and use secure headers.

Backups and monitoring

• Daily backups (database + files) with offsite copy.
• Uptime monitoring and basic security alerts.
• Regular malware scans.

FAQ

Which plugin is best? Choose one reputable security plugin; avoid stacking multiple plugins that conflict.