Hardening Your Self-Hosted WordPress Site

WordPress is the most popular CMS in the world, and that popularity makes it a target. Automated vulnerability scanners probe every WordPress site for known weaknesses: default admin URLs, outdated plugins, weak passwords, and exposed configuration files. A self-hosted WordPress site is secure, but only if you harden it properly from day one.

1. File Permissions

The most common WordPress vulnerability is writable files. Set your file permissions correctly: all files should be owned by a non-privileged user, with directories at 755 and files at 644. The wp-config.php file should be 440 or 400 read-only to the web server user, with no world-readable permissions. The uploads directory needs write access, but PHP execution within uploads should be disabled via the web server configuration. Never run the web server as root. Never use 777 permissions on any file or directory.

2. Disable XML-RPC

XML-RPC is enabled by default and is the vector for most brute-force attacks against WordPress. Unless you use the WordPress mobile app or a remote publishing tool that requires XML-RPC, disable it entirely. A single line in your Nginx configuration blocks all XML-RPC requests before they reach WordPress.

3. Block PHP Execution in Uploads and Plugins

If an attacker manages to upload a PHP file through a vulnerable plugin or theme, that file should not execute. Configure your web server to deny PHP execution in the wp-content/uploads, wp-content/plugins, and wp-content/themes directories. This contains any breach to file access rather than code execution.

4. Keep Everything Updated, Automatically

The leading cause of WordPress compromises is outdated plugins and themes. Enable automatic updates for WordPress core, plugins, and themes. Use a monitoring tool to alert you when updates are available. Never run abandoned plugins that have not been updated in over a year. Each unmaintained plugin is a potential entry point.

5. Use a Web Application Firewall

A WAF like ModSecurity or the free Cloudflare WAF blocks SQL injection, cross-site scripting, and other common attacks before they reach your application. It is a safety net that catches what your hardening misses. For self-hosted WordPress behind a reverse proxy, ModSecurity with the OWASP Core Rule Set provides strong protection.

6. Database and wp-config.php Security

Change the default table prefix from wp_ to something unique during installation. Move wp-config.php one directory above the web root so it cannot be accessed via a browser. Use strong, randomly generated database passwords and salts. Store credentials in environment variables or a secrets manager, never hard-coded in configuration files.

Ongoing Maintenance

WordPress security is not a one-time setup. It requires regular plugin audits, security log reviews, and update management. VPS1 handles the full security lifecycle for managed WordPress deployments: initial hardening, automated updates, WAF configuration, and continuous monitoring.