WordPress Hardening Checklist

WordPress powers more than 40% of all websites, which makes it the first target for automated bot attacks. Run it with default settings and you are exposed to brute-force logins, vulnerable-plugin exploitation, user enumeration and XML-RPC amplification out of the box. This checklist gathers the highest-impact hardening steps — from login security to file permissions, exposure reduction, backups and HTTPS — in one place.

As you tick each item, a readiness score (%) is computed in real time and shown as an OK / caution / risk status. Everything runs in your browser; your input and checkbox state are never sent anywhere. Use it before launching a new site or during a periodic security audit.

Why WordPress hardening matters

Most WordPress compromises start not with a zero-day but with neglected defaults and outdated plugins. Attackers brute-force /wp-login.php, harvest usernames via/wp-json/wp/v2/users, and scan for plugins with known vulnerabilities. Hardening is about shrinking that automated attack surface.

Core measures, in priority order

• Login security: two-factor auth (2FA), login attempt limits and strong passwords give the best return.
• Updates: keep core, plugins and themes current, and delete anything you no longer use.
• File protection: block access to wp-config.php and set DISALLOW_FILE_EDIT to disable in-dashboard code editing.
• Reduce exposure: hide version info, block unused XML-RPC, and stop REST API user enumeration.
• Be ready to recover: automated backups and end-to-end HTTPS decisively limit damage when something goes wrong. Verify your response carries the right headers with the security headers check, and tighten your content policy with the CSP generator.

Permission baseline

As a rule of thumb, set directories to 755, files to 644, andwp-config.php to 640 or 600. Minimize directories the web server can write to, and never use 777.

wp-config.php constants quick reference

Several items in this checklist boil down to adding a few constants to wp-config.php. Here are the most common hardening constants and what they do. Always add them above the/* That's all, stop editing! */ comment.

Example: first-pass lockdown of a suspected breach

Say you get a report that an unknown admin user has appeared. Before you start reading code, you can cut the attacker off immediately in this order.

• 1) Regenerate salts: paste the 8 lines from api.wordpress.org/secret-key/1.1/salt/ over your existing keys/salts in wp-config.php → every stolen login cookie becomes invalid and all sessions are forced to log out.
• 2) Rotate passwords: change the admin password and delete any unrecognized admin accounts.
• 3) Lock down file edits: add define('DISALLOW_FILE_EDIT', true); to close the code-injection path on re-entry.
• 4) Re-check: ticking these items in this checklist instantly raises your readiness (%) and surfaces the remaining risk items (backups, 2FA, etc.) at a glance.

Common pitfall

The auth keys/salts at the top of wp-config.php are unrelated to login passwords. Changing only the salts invalidates existing session cookies (forcing a logout), but any account password the attacker already knows still works. Conversely, changing only the password while leaving the salts in place can let a stolen cookie keep a session alive. When responding to a breach, always rotate both.