Most “security checklists” are theatre — twenty tweaks that feel productive while the actual attack surface stays wide open. Real hardening is less glamorous: it is closing the doors attackers genuinely use. Here is the list that earns its keep, roughly in order of impact.
1. Make updating non-negotiable
The overwhelming majority of WordPress compromises exploit a known vulnerability in an outdated plugin or theme — one with a patch already available. Enable auto-updates for minor core releases and for trusted plugins, and put a weekly slot in the calendar for the rest. Remove anything abandoned: a plugin without updates for two years is a liability regardless of what it does.
2. Least privilege, strong auth
Every account is attack surface. Editors do not need admin; the marketing intern does not need to install plugins. Assign the lowest role that works, delete accounts that left the company, and require two-factor authentication for anyone with admin. Long unique passwords from a manager — no exceptions for “temporary” accounts, which are never temporary.
3. Disable what attackers use
define('DISALLOW_FILE_EDIT', true);— removes the in-dashboard code editor, which turns any compromised admin login into instant code execution.- Block xmlrpc.php if nothing uses it — it multiplies brute-force attempts.
- Disable PHP execution in
/uploads/via server config — uploads should never run code.
4. Fix file permissions and secrets
Directories 755, files 644, wp-config.php 600 (or as strict as the host allows). Fresh, unique salts in wp-config. Database user with only the privileges WordPress needs. None of this stops a determined attacker alone — together, they make every step of an attack noisier and harder.
5. Monitor, and have a way back
Hardening without detection means a breach runs unnoticed for months. File-integrity monitoring, login attempt alerts, and — above all — tested off-site backups. The backup is the security control of last resort, and the one that turns a disaster into an inconvenience. This posture, maintained on a schedule, is most of what a maintenance plan is.