WordPress hardening.
Closing the attack surface before the attack arrives. The editorial position is that most WordPress compromises are preventable at the configuration layer, and that hardening work is cheaper, faster, and more durable than cleanup. This is where that work lives.
What this desk covers.
Six beats. Each is a distinct hardening surface. We cover them as procedures we have actually run on live installs, not as lists we found on someone else’s blog.
Authentication
Strong passwords, two-factor authentication, login URL controls, brute-force lockouts, session hijack detection. The single largest intrusion vector in our incident data.
File and permission hygiene
WordPress file and directory permissions, ownership under the web user, read-only wp-config.php where possible, permissions drift detection. Mundane and high-impact.
HTTP attack surface
XML-RPC, REST API permission callbacks, pingback controls, file-edit disable, directory indexing. The WordPress endpoints attackers hit first.
Security headers
HSTS, Content-Security-Policy, X-Frame-Options, Referrer-Policy. The hardening layer most WordPress sites never configure and Google silently penalizes.
Updates and patch policy
Core, plugin, and theme update cadence. Auto-update policy. Release-candidate testing. The operational discipline that keeps known-vulnerable code off production.
Backups and recovery
What to back up, where, how often, and how to restore under pressure. The hardening layer you only appreciate at 3am on the day of a compromise.
Pieces from this desk.
How to secure a WordPress site: the complete hardening model
The strategic view of WordPress security. Threat model, attack surface, the eight defensive layers, what to automate and what to operate by hand. Links to every tactical piece.
The fifteen-minute WordPress security checklist we follow
Eight steps in a specific order. The ones that close the attack surface real scanners actually touch. Commands and config, not feature talk.
WordPress malware protection: the four layers that actually work
Malware protection on WordPress is not one product, it is four layers: edge, scanner, patching, cleanup. The tradeoffs at each, and plugin recommendations by site profile.
WordPress DDoS protection: target, weapon, and what stops both
XMLRPC amplification and pingback reflection turn default WordPress into a DDoS weapon. The close-the-weapon steps first, then inbound edge defence, origin-IP hiding, and application-layer rate limits.
When hardening is not enough.
Hardening reduces incident probability. It does not eliminate it. The pieces below are what runs when a compromise happens anyway, and the tools we evaluate for automating the hardening layer on sites with more than a handful to manage.
WordPress malware removal: the procedure we run on client sites
Identify, clean, close the door, verify. The reactive procedure when the hardening layer did not hold.
Best WordPress security plugins, adjusted for reality
The five plugins we evaluate for automating parts of the hardening layer. Ranked by technical merit, not commission rate.