Protecting WordPress installations requires a layered approach that focuses on securing critical files, enforcing strict permissions, and monitoring for unauthorized changes.
Critical Files to Protect
- wp-config.php: Contains database credentials and security keys. Restrict permissions to
600 and, if possible, move it one directory above the web root.
- .htaccess: Controls server behavior. Lock down editing and ensure only administrators can modify it.
- wp-admin/: Limit access by IP or enforce two-factor authentication for all admin accounts.
- wp-login.php: Frequently targeted by brute-force bots. Add rate limiting, CAPTCHAs, or secondary authentication.
- uploads/: A common injection point. Disable PHP execution in this directory.
Best Practices
- Keep WordPress core, plugins, and themes updated. Outdated plugins account for most vulnerabilities.
- Use proper file permissions:
644 for files, 755 for directories, and stricter settings (600) for sensitive files.
- Add two-factor authentication for all admin and editor accounts.
- Disable XML-RPC unless required, as it can be exploited for brute-force and DDoS attacks.
- Maintain off-site backups of both files and databases, and test restoration regularly.
- Deploy a Web Application Firewall (WAF) to block malicious traffic before it reaches WordPress.
- Monitor activity logs to detect unauthorized changes, fake admin accounts, or hidden cron jobs.
Risks and Challenges
- Brute Force Attacks: Bots target
wp-login.php and xmlrpc.php. Without 2FA and rate limiting, these can succeed.
- Plugin Vulnerabilities: Abandoned or outdated plugins are the most common entry points.
- File Injection: Writable directories like
uploads/ can be exploited if not properly restricted.
- Insider Threats: Shared credentials or unmonitored admin accounts increase risk.
Join The Discussion
Securing WordPress isn’t just about installing security plugins—it’s about consistent habits and server-level hardening. How do you balance ease of management with strict security controls on your WordPress sites? Share your experiences with protecting files like wp-config.php, managing plugin updates, or handling brute-force attacks. What best practices, challenges, or recommendations would you give to others running WordPress today?
