WordPress hardening step by step: 12 settings that stop most automated attacks

Almost no attack on a WordPress site is personal. Automated bots scan the entire internet around the clock, looking for weak login pages and outdated plugins, then try thousands of passwords per minute. It doesn't matter that your site is a small salon or a local shop — if it runs WordPress, you're on the list.

The good news: most of these attacks are automated and dumb. You're not being targeted by a genius hacker, just by a script looking for unlocked doors. That means a small set of correct settings stops the bulk of them. Below are 12 hardening steps, in the order worth doing them, and what each one fixes. No marketing, no promises of "100% secure" — because nobody serious guarantees that.

Why you get attacked even if your site is tiny

The belief that "nobody's looking at my site" is the most expensive security mistake there is. Bots don't pick victims — they scan in bulk: they look for /wp-login.php, brute-force passwords, probe for known-vulnerable plugins, and try to inject code.

Why you stay on the list even with no traffic:

• your server can be used to send spam or attack other sites;
• your pages can be stuffed with hidden links to fake pharmacies or casinos, wrecking your Google reputation;
• customer data (forms, orders) has value in itself.

So you're not defending against an enemy — you're defending against the background noise of the internet. And background noise is stopped with hygiene, not magic.

Settings 1–4: lock down authentication

Most break-ins simply walk in the front door — the login page. This is where you get the biggest win for the least effort.

• 1. Remove the "admin" user. It's the first name any bot tries. Create a new admin account with a different name and delete the old one.
• 2. Long, unique passwords. At least twenty characters, generated with a password manager (Bitwarden, 1Password). Never reuse a password anywhere.
• 3. Turn on two-factor authentication (2FA). Even if your password is guessed or stolen, the attacker is stuck without the code on your phone. Plugins like Wordfence or miniOrange add it in minutes.
• 4. Limit login attempts. Set an automatic lockout after a few wrong passwords. This kills brute-force attacks, which depend on thousands of tries.

Settings 5–8: shrink your attack surface

Every active plugin, theme, and feature is one more door. The fewer you have, the less you have to defend.

• 5. Update everything, automatically. WordPress core, themes, and plugins. The vast majority of break-ins exploit a vulnerability that's already been patched — the owner just never applied the update. Turn on automatic updates at least for security fixes.
• 6. Delete what you don't use. Deactivated themes and plugins can still be exploited. If it isn't active and needed, remove it fully, don't just disable it.
• 7. Disable the file editor in the dashboard. Add `define('DISALLOW_FILE_EDIT', true);` to wp-config.php. That way, if someone steals your account, they can't inject code straight from the dashboard.
• 8. Turn off XML-RPC if you don't use it. It's an old channel often abused for brute-force and amplification attacks. Most security plugins can close it with one switch.

Settings 9–12: server, permissions, and a safety net

The last layer is about files, the connection, and what happens when something slips through anyway.

• 9. Correct file permissions. Directories at 755, files at 644, and wp-config.php at 640 or 600. Nothing should be set to 777. Ask your host for this if you don't have access.
• 10. HTTPS everywhere. An active SSL certificate and a forced redirect from http to https, so passwords and form data don't travel in the clear.
• 11. A security plugin with a firewall (WAF). Wordfence or Solid Security filter bad traffic before it reaches the site and send you alerts. Not mandatory, but it plugs many holes from one place.
• 12. Automatic, off-site backups. The single most important setting on this list. A daily or weekly copy, stored separately (not on the same server). When everything else fails, a good backup turns a disaster into an hour of work.

Things that feel like security but do nothing

Not everything that looks like protection actually protects. A few things you'll often see recommended that matter less than you'd think:

• Hiding your WordPress version. Bots attack everything regardless; they don't pick by version. It's cosmetic.
• Changing the database table prefix on an existing site. Risky with little benefit; it only makes sense at install time, not retroactively.
• Moving the login page to another URL. It discourages simple scans, but doesn't replace 2FA and login limiting. It's a bonus, not a solution.

The sane rule: do the things that matter first — authentication, updates, backups — and only then the refinements. And run from anyone who promises your site becomes "unhackable." There's no such thing; there are only sites hard enough to break into that the bot moves on to the next one.

Where to start and how we can help

If you want to do this yourself, go in the order above: authentication first (admin user, password, 2FA, login limiting), then updates and backups. Those four steps alone remove the bulk of automated attacks. The rest is refinement.

If you'd rather not touch wp-config.php and permissions, that's completely fair — it's easy to break a site with one stray comma. At MPO Web Studio we work remotely, across the whole country, and we can run a security audit on your WordPress site, apply the hardening, and set up automatic backups — with pricing stated up front. We even build a demo before you pay anything, so you can see who you're working with.

Message us on WhatsApp with your site address and we'll tell you briefly where you're exposed and what's worth doing first. No unnecessary jargon.