WordPress powers over 43% of the web, making it a constant target for automated attacks. Brute force login attempts, SQL injection probes, and vulnerability scanners hit WordPress sites millions of times daily. While no site can be completely immune to attack, proper hardening dramatically reduces your risk profile.
This guide covers the security hardening measures every WordPress site should implement, from web application firewalls to two-factor authentication.
Web Application Firewall (WAF)
A Web Application Firewall filters malicious traffic before it reaches your WordPress site. Cloudflare’s WAF is the most popular option, offering a free tier that blocks common attack patterns like SQL injection and XSS. Sucuri’s WAF and Wordfence’s firewall are WordPress-specific alternatives with additional features like malware scanning.
Configure your WAF to block malicious requests, rate-limit login attempts, and challenge suspicious traffic with CAPTCHA. Review WAF logs weekly to see what attacks are being blocked and adjust rules as needed.
Two-Factor Authentication
Two-factor authentication (2FA) adds a second verification step beyond your password. Even if an attacker steals your password, they can’t log in without the second factor. For WordPress, the most common 2FA methods are authenticator apps like Google Authenticator or Authy, one-time codes sent via email or SMS, and hardware security keys like YubiKey.
Install a 2FA plugin like Two Factor, Wordfence Login Security, or WP 2FA. Require 2FA for all administrator accounts and encourage it for all users. For high-value sites, make 2FA mandatory for all users with editing capabilities.
Login Hardening
Brute force attacks try thousands of username and password combinations to gain access. Limit login attempts with a plugin like Login LockDown or Limit Login Attempts Reloaded. Change the default admin username from ‘admin’ to something unique. Use strong, unique passwords generated by a password manager.
Consider hiding the WordPress login URL with a plugin like WPS Hide Login. This stops automated bots that target wp-login.php and wp-admin. Add IP allowlisting for admin access if your team accesses WordPress from a limited set of IP addresses.
File Permissions and WP-Config
Incorrect file permissions are a common security vulnerability. Set directory permissions to 755 and file permissions to 644. The wp-config.php file should be 600 or 440 — readable only by the web server user. Move wp-config.php up one directory level from the WordPress root for additional protection.
Disable file editing in the WordPress admin by adding define(‘DISALLOW_FILE_EDIT’, true) to wp-config.php. This prevents compromised admin accounts from editing theme and plugin files through the admin interface.
Regular Security Audits
Security is not a one-time configuration — it’s an ongoing practice. Run regular security audits using tools like WPScan, which checks your WordPress version, plugins, and themes against known vulnerabilities. Review user accounts regularly and remove inactive or unnecessary accounts.
Monitor your site’s security logs for suspicious activity. Failed login attempts from unusual locations, unexpected file changes, and new admin user registrations are all warning signs. Set up automated alerts for these events so you can respond quickly.
The Bottom Line
WordPress security hardening is about reducing your attack surface and detecting attacks early. A WAF blocks common attack patterns, 2FA protects against credential theft, login hardening prevents brute force attacks, and proper file permissions limit the damage from compromised accounts. None of these measures are difficult to implement, and together they protect against the vast majority of common WordPress attacks.