WordPress hardening: 12 settings worth doing today

2026-08-03 · updated 2026-10-07

Most of the breaches we have investigated were possible because of a handful of basics. These settings close them.

Access control

1. Two-factor authentication on every administrator account.
2. A separate account per person — no shared “admin” logins.
3. Editor rights for anyone who does not need administrator.
4. Login attempt limiting at server level, not only through a plugin.

Files and configuration

5. define( 'DISALLOW_FILE_EDIT', true ); — the admin file editor off.
6. PHP execution blocked in wp-content/uploads.
7. File permissions 644, directories 755, wp-config.php 600.
8. XML-RPC disabled if you do not use it.

Maintenance

9. Updates on a schedule, with a backup first and testing.
10. Unused themes and plugins deleted, not just deactivated.
11. Backups with verified restores.
12. Log monitoring: new users, file changes, failed logins.

Point ten surprises people most often: a deactivated plugin is still files on the server, reachable directly. If it contains a vulnerability, deactivation does not protect you.

All of this is included in technical maintenance; you can start with the free security check.