WordPress Security Guide

Knowledge Base
1

Why is WordPress Security Important?

WordPress powers 43% of all websites globally, making it a prime target for hackers. Common attacks include:

  • Brute force login attacks
  • SQL injection
  • Cross-Site Scripting (XSS)
  • Malicious file uploads
  • Backdoor implantation

Basic Security Measures

1. Keep Everything Updated

The most important security measure:

  • Update the WordPress core promptly
  • Keep themes and plugins up-to-date
  • Upgrade PHP version to 8.x
// Enable automatic updates (wp-config.php)
define("WP_AUTO_UPDATE_CORE", true);

2. Strong Password Policy

  • Administrator password at least 16 characters
  • Include uppercase, lowercase, numbers, and special characters
  • Use different passwords for different websites
  • Use a password manager

3. Limit Login Attempts

Recommended plugins:

  • Limit Login Attempts Reloaded
  • Wordfence
  • Login LockDown

Configuration suggestions:

  • Lock after 5 failed attempts for 15 minutes
  • Log IP addresses of failed login attempts

4. Two-Factor Authentication (2FA)

Recommended solutions:

  • Google Authenticator
  • Wordfence 2FA
  • Two Factor Authentication plugin

Advanced Security Configuration

Change Default Login URL

// Use a plugin like WPS Hide Login
// Or configure in .htaccess

Disable File Editing

// wp-config.php
define("DISALLOW_FILE_EDIT", true);

Protect wp-config.php

# .htaccess
<files wp-config.php>
order allow,deny
deny from all
</files>

Disable XML-RPC

If remote publishing is not needed:

# .htaccess
<Files xmlrpc.php>
order deny,allow
deny from all
</Files>

Set Correct File Permissions

Directories: 755
Files: 644
wp-config.php: 600

Recommended Security Plugins

Plugin Features Suitable For
Wordfence Comprehensive, firewall + scanning Most websites
Sucuri Cloud firewall, CDN High-traffic websites
iThemes Security Easy configuration Beginners
All In One WP Security Rich free features Limited budget

Backup Strategy

3-2-1 Backup Principle

  • 3 backup copies
  • 2 different storage media
  • 1 offsite backup

Recommended Backup Plugins

  • UpdraftPlus (free version is sufficient)
  • BlogVault (real-time backup)
  • Jetpack Backup

Recommended Backup Frequency

Website Type Recommended Frequency
Blog Weekly
E-commerce Daily
Frequently Updated Real-time

Emergency Response If Hacked

Step 1: Isolate

  1. Enable maintenance mode
  2. Change all passwords
  3. Notify your hosting provider

Step 2: Analyze

  1. Check recently modified files
  2. Review access logs
  3. Scan for malicious code

Step 3: Clean

  1. Restore from a clean backup
  2. Or manually clean malicious code
  3. Update all components

Step 4: Harden

  1. Install security plugins
  2. Enable 2FA
  3. Set up monitoring alerts

Security Checklist

  • WordPress core is the latest version
  • All plugins and themes are updated
  • Using strong passwords
  • Two-factor authentication enabled
  • Login attempts limited
  • Regular backups performed
  • Security plugin installed
  • Using HTTPS
  • Unused themes and plugins deleted
  • File editor disabled

Security issues? You can @security experts for help with diagnosis!