WordPress security hardening: close the gaps before they become an incident
Many WordPress compromises don't involve clever attacks. They use an outdated plugin, a reused password or an account that should have been removed long ago. We review your install, lock down the weak points and tell you plainly what we changed and what still needs attention.
Hardening is scoped per site, based on size, plugin count, hosting setup and current condition. Tell us about yours and we'll come back with a scope and price. Hardening reduces risk and limits attack surface; it can't make a site unhackable.
The areas that decide how exposed a site is
These are the weak points most WordPress sites share, and where hardening time is best spent.
Updates and vulnerability management
Whether WordPress core, plugins and themes are current, how updates are applied, and whether any installed component has a known vulnerability or is abandoned.
Plugin and theme security
Unmaintained or risky plugins and themes, and anything installed that nobody uses. Every extra plugin is extra attack surface.
Admin accounts, least privilege and MFA
Dormant and shared accounts, administrators who don't need to be, role assignments and two-factor authentication for privileged users.
Login protection and password hygiene
How easily the login can be guessed or brute-forced, rate limiting, and whether credentials are unique and strong.
Backups
Recent backups stored away from the server, and whether anyone has checked that one restores.
File permissions and WordPress configuration
Permissions, the built-in file editor, whether PHP can run from uploads, and sensitive settings in wp-config.php.
Security headers and exposure
HTTPS, response headers and files or endpoints that reveal more than they should.
Monitoring and server considerations
What alerts you when something changes, and server or hosting settings that widen the door.
How a hardening engagement works
We review first and change second, so nothing happens on your live site that you haven't been told about.
Review
We go through the install, users, plugins, themes, settings and backups, and note what is exposed and what is fine.
Prioritize
You get a plain list ordered by risk: what matters now, what can wait and what each change could affect on your site.
Apply
We make the agreed changes carefully, with a backup in place first, and check that the site still behaves the way it should.
Document and hand over
A written summary of what we found, what we changed and what we recommend next, so you aren't relying on anyone's memory.
What a hardened WordPress install looks like
A starting checklist you can work through yourself. It takes care and some technical comfort. A longer version for businesses is in the WordPress security checklist for small businesses.
- WordPress core, plugins and themes are up to date, with a clear owner for updates
- Unused plugins and themes are deleted, not just deactivated
- Every administrator has a unique, strong password and two-factor authentication
- People have the lowest role they need, and former staff and agencies have no account
- Repeated failed logins are limited
- The built-in file editor is turned off, so a stolen admin session can't edit code from the dashboard
- PHP can't be executed from
wp-content/uploads - The site runs over HTTPS, and
wp-config.phpisn't readable from the web - Backups are stored off the server, are recent and have been test-restored at least once
- Someone gets alerted when an administrator is added or a file changes unexpectedly
Good times to harden a site
After a cleanup
Removing malware doesn't remove the weakness that let it in. See malware removal and securing WordPress afterwards.
Before or after launch
A new site or redesign is the cheapest moment to get access, backups and updates right.
After a handover
A new agency or developer, or an old one leaving, is when forgotten accounts and shared passwords pile up.
When nobody has touched it for a while
If nobody remembers when the plugins were last updated, the site is probably already drifting out of date.
Priced to the site, not a package
Scope depends on site size, plugin count, hosting setup and current condition. Send us the details and we'll come back with what we'd do and what it costs.
Hardening is a snapshot. To keep a site in that state, managed WordPress security covers update oversight, regular security checks and backup verification from $79/mo.
A hardening review covers
- Access control and user review
- Update status and plugin risk
- Login protection
- Backup check
- A written summary and recommendations
Hardening FAQ
Could hardening break my site?
Some measures can affect how plugins or custom code behave. That's why we review first, tell you what each change touches, and keep a backup before changing anything.
Isn't a security plugin enough?
A plugin can help with some of this, such as login limits and alerts. It can't remove unused accounts, fix a missing backup process or decide which plugins to drop.
What access do you need?
Usually a temporary administrator account plus file and hosting access for the server-side items. You remove it when we're done.
Will hardening make my site unhackable?
No. It reduces risk and limits what an attacker can do. Anyone promising an unhackable site is overselling.
My site was just hacked. Is this the right page?
Start with the emergency steps. Hardening comes after the site is clean.
Tell us about your site
Send a short message: your website, what you're seeing, and who hosts it. We'll get back to you with next steps.