To secure a WordPress site, focus on the steps with the biggest effect: keep core, plugins and themes updated, delete what you do not use, protect logins with a strong unique password and two-step authentication, restrict file permissions and editing, use HTTPS and SFTP, and keep backups you can restore. Most of the rest is refinement. This article ranks the steps by importance, using WordPress’s own developer documentation.
Priority 1: Updates and plugin hygiene
WordPress’s hardening guide says older versions are not maintained with security updates, recommends enabling automatic updates (available since version 3.7) and keeping plugins and themes current (Hardening WordPress).
Plugins deserve particular attention because every plugin is extra code that runs on your site:
- Delete plugins and themes you do not use. Deactivated is not the same as removed.
- Install only from trusted sources, such as the WordPress.org repository.
- Avoid plugins that execute PHP stored in the database.
- Before adding a plugin, ask whether a simpler approach exists. Fewer plugins means fewer things to update and fewer things to break.
- Assign an owner to check for updates on a regular schedule, and test important updates on a copy if your site is complex.
Priority 2: Login protection
Accounts and passwords
The same guide advises avoiding usernames like “admin” or “webmaster”, renaming existing ones, and using a strong, unique password. It also recommends enabling two-step authentication.
Two-step authentication
WordPress’s authentication documentation explains the three factor types (something you know, have or are), and that most implementations pair a password with a phone. It says SMS is not a secure channel, so apps and plugins are preferred, and lists Two-Factor and other plugins as options. It names the drawbacks honestly too: extra friction and lockouts if you lose your phone (Two-Step Authentication). Keep recovery codes safe, and enable it at least for every administrator and editor.
Principle of least privilege
Give each person their own account with the lowest role needed, and remove accounts when people leave. See website security basics for the non-WordPress-specific version.
Priority 3: Files and configuration
The hardening guide gives specific settings:
| Setting | Recommendation |
|---|---|
| Directory permissions | 755 |
| File permissions | 644 |
| wp-config.php | Restrict to 400 or 440, and block web access |
| Dashboard file editor | Disable with define( 'DISALLOW_FILE_EDIT', true ); |
| Admin connections | Use HTTPS and SFTP, not plain FTP |
The guide notes that experts disagree on how much moving wp-config.php above the web root helps, and that disabling the file editor will not stop malicious uploads. That is a useful reminder that no single setting is a shield. Permissions are best set by your host or developer, because wrong values can break uploads or updates.
Priority 4: Backups you can restore
WordPress’s backup guide says a complete backup has two parts, the database and the files, and that a files backup does not include the database. It suggests weekly backups for small sites and daily for high-activity ones, keeping at least three to five recent backups, storing them in more than one place, and always backing up before an upgrade. It also recommends periodically running a manual backup to confirm the automated process works (WordPress Backups). Test a restore on a staging copy at least once, so you know it works before you need it.
Priority 5: Monitoring
Verify your site in Google Search Console and check the security issues report, which flags hacked content, malware and deceptive pages (Security issues report). If an issue appears, fix it throughout the site, not just on a few pages, then request a review.
What not to over-invest in
- Stacking several security plugins that overlap and slow the site.
- Hiding the WordPress version or login URL as the main defence. It adds little compared with updates and strong authentication.
- Buying a premium plugin without checking what it covers. Match tools to the gaps in the table above.
Weekly and monthly routine
- Weekly: check for updates, review failed login or security alerts, confirm last backup succeeded.
- Monthly: review user accounts, remove unused plugins, check Search Console security and indexing.
- Quarterly: restore a backup to staging and review hosting and PHP version.
The architectural alternative
A plugin-heavy CMS has a larger attack surface than a static site, which is one reason some businesses choose a different platform. Astro vs WordPress compares them fairly, including when WordPress is the better choice. Speed also matters for the same visitors: see website speed and Core Web Vitals.
Where Radiance Impact fits
Radiance Impact’s Technology team builds business websites and provides maintenance and care. If you want help reviewing a WordPress site’s setup or deciding whether to stay on it, see /technology or contact us.
Sources
- Hardening WordPress, WordPress.org Developer Resources
- Two-Step Authentication, WordPress.org Developer Resources
- WordPress Backups, WordPress.org Developer Resources
- Security issues report, Google Search Console Help
