Lock down your WordPress site with battle-tested security techniques. Protect against hackers, malware, and unauthorized access.
Secure your WordPress login system against brute force attacks and unauthorized access.
// Database query to change username
UPDATE wp_users SET user_login = 'new_admin_name'
WHERE user_login = 'admin';
// Or create new admin user via functions.php
function create_secure_admin() {
$username = 'secure_admin_' . wp_generate_password(6, false);
$password = wp_generate_password(16, true);
wp_create_user($username, $password, 'admin@yoursite.com');
}
Never use 'admin' as your username. Attackers target this first in brute force attacks.
// Add to functions.php
function limit_login_attempts() {
$attempts = get_option('failed_login_attempts', array());
$ip = $_SERVER['REMOTE_ADDR'];
$max_attempts = 3;
$lockout_time = 30 * 60; // 30 minutes
if (isset($attempts[$ip]) && $attempts[$ip]['count'] >= $max_attempts) {
wp_die('Too many failed attempts. Try again later.');
}
}
add_action('wp_login_failed', 'track_failed_login');
Blocks IP addresses after multiple failed login attempts to prevent brute force attacks.
// Enable 2FA with a plugin or custom code
function enable_2fa_verification() {
// Install: Two Factor Authentication plugin
// Or custom implementation:
$secret = wp_generate_password(16, false);
update_user_meta($user_id, '2fa_secret', $secret);
// Verify TOTP code on login
$is_valid = verify_totp_code($user_code, $secret);
}
Adds an extra layer of security requiring a second authentication factor beyond passwords.
// Add to .htaccess
Order Deny,Allow
Deny from all
Allow from YOUR.IP.ADDRESS.HERE
// Or use functions.php for dynamic IP
function restrict_admin_access() {
$allowed_ips = ['192.168.1.100', '203.0.113.0'];
if (!in_array($_SERVER['REMOTE_ADDR'], $allowed_ips)) {
wp_die('Access denied');
}
}
Restricts wp-admin access to specific IP addresses, blocking unauthorized admin access attempts.
Strengthen your WordPress core against common attack vectors
// Add to functions.php
function disable_xmlrpc() {
// Completely disable XML-RPC
add_filter('xmlrpc_enabled', '__return_false');
// Remove RSD link
remove_action('wp_head', 'rsd_link');
}
add_action('init', 'disable_xmlrpc');
// Also block via .htaccess
Order Deny,Allow
Deny from all
XML-RPC is commonly exploited for DDoS amplification attacks and brute force attempts.
// Add to functions.php
function add_security_headers() {
header('X-Content-Type-Options: nosniff');
header('X-Frame-Options: SAMEORIGIN');
header('X-XSS-Protection: 1; mode=block');
header('Referrer-Policy: strict-origin-when-cross-origin');
header('Permissions-Policy: geolocation=(), microphone=(), camera=()');
// Content Security Policy (basic example)
header("Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline'");
}
add_action('send_headers', 'add_security_headers');
Implements browser security headers to protect against XSS, clickjacking, and content injection attacks.
// Add to .htaccess
Order Deny,Allow
Deny from all
Order Deny,Allow
Deny from all
# Block PHP execution in uploads
Order Deny,Allow
Deny from all
Prevents direct access to sensitive configuration files and blocks PHP execution in uploads directory.
// Add to wp-config.php
// Disable file editing in wp-admin
define('DISALLOW_FILE_EDIT', true);
// Disable file modifications (theme/plugin install)
define('DISALLOW_FILE_MODS', true);
// Force SSL for admin
define('FORCE_SSL_ADMIN', true);
// Limit post revisions
define('WP_POST_REVISIONS', 3);
Prevents theme and plugin editing through the admin panel, reducing attack surface if admin is compromised.
Deploy advanced firewall rules and malware protection to block threats before they reach your site.
# Basic WAF rules in .htaccess
# Block common attack patterns
RewriteCond %{QUERY_STRING} (<|%3C).*script.*(>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2}) [OR]
RewriteCond %{QUERY_STRING} base64_(en|de)code [NC]
RewriteRule ^(.*)$ - [F,L]
# Block suspicious user agents
RewriteCond %{HTTP_USER_AGENT} (libwww-perl|wget|nikto|curl) [NC]
RewriteRule ^(.*)$ - [F,L]
Implements basic WAF rules to block common SQL injection, XSS, and malicious bot traffic at the server level.
// Add to functions.php
function monitor_file_changes() {
$core_files = ['wp-config.php', 'wp-admin/index.php'];
foreach ($core_files as $file) {
$current_hash = md5_file(ABSPATH . $file);
$stored_hash = get_option('file_hash_' . md5($file));
if ($stored_hash && $current_hash !== $stored_hash) {
wp_mail('admin@yoursite.com', 'File Changed', 'File: ' . $file);
}
update_option('file_hash_' . md5($file), $current_hash);
}
}
wp_schedule_event(time(), 'hourly', 'monitor_file_changes');
Monitors critical WordPress files for unauthorized changes and sends alerts when modifications are detected.
// Add to functions.php
function secure_file_uploads($file) {
// Allowed file types
$allowed_types = ['jpg', 'jpeg', 'png', 'gif', 'pdf'];
$file_ext = strtolower(pathinfo($file['name'], PATHINFO_EXTENSION));
if (!in_array($file_ext, $allowed_types)) {
$file['error'] = 'File type not allowed';
}
// Check for PHP code in uploads
$content = file_get_contents($file['tmp_name']);
if (strpos($content, '
}
add_filter('wp_handle_upload_prefilter', 'secure_file_uploads');
Validates uploaded files to prevent malicious code injection and restricts file types to safe formats.
// Add to functions.php
function implement_rate_limiting() {
$ip = $_SERVER['REMOTE_ADDR'];
$requests = get_transient('rate_limit_' . md5($ip));
$limit = 60; // 60 requests per minute
if ($requests === false) {
set_transient('rate_limit_' . md5($ip), 1, 60);
} else if ($requests < $limit) {
set_transient('rate_limit_' . md5($ip), $requests + 1, 60);
} else {
header('HTTP/1.1 429 Too Many Requests');
wp_die('Rate limit exceeded. Please slow down.');
}
}
add_action('init', 'implement_rate_limiting');
Limits the number of requests per IP address to prevent DDoS attacks and server overload.
Essential tools and plugins for continuous security monitoring
Comprehensive security plugin with firewall, malware scanner, and real-time threat protection.
Website firewall, DDoS protection, and malware removal with 24/7 monitoring.
30+ security measures including brute force protection, file change detection, and malware scanning.
Comprehensive activity logging to track all changes and user actions on your website.
User-friendly security plugin with firewall, login protection, and database security features.
Automated security scanning, brute force protection, and downtime monitoring by Automattic.
Essential security measures to implement on every WordPress site
Real-time security assessment based on implemented measures
Multi-factor protection
WordPress protection
Active protection
Threat detection