KeenWP

Curated resource guide

WordPress Hardening Resources

Harden production WordPress sites without relying on disruptive tricks or security folklore. The selected guidance covers least privilege, strong authentication, file and server controls, secrets, HTTPS, headers, WAF and rate limiting, backups, logging, staging protection, and changes that preserve legitimate WordPress behavior.

Scope

What this guide covers

  • Production hardening
  • least-privilege users
  • strong authentication and 2FA
  • file and directory permissions
  • wp-config.php protection
  • salts and secrets
  • disabling unnecessary features
  • admin access controls
  • XML-RPC considerations
  • REST exposure decisions
  • security headers
  • HTTPS/TLS
  • WAF
  • rate limiting
  • brute-force protection
  • database credentials
  • server/PHP hardening
  • directory listing
  • file-edit restrictions
  • backups
  • logging
  • monitoring
  • staging protection
  • Cloudflare/CDN controls
  • and hardening without breaking legitimate WordPress functionality

Selected references

Curated resources

Links open the original publisher so you can use the complete, current material in context.

  1. 01
    5
    Recommended starting point

    Hardening WordPress

    The official baseline for reducing risk across updates, accounts, files, configuration, databases, transport, and monitoring.

    developer.wordpress.org
  2. 02
    5

    Changing WordPress File Permissions

    Set practical ownership and permissions without relying on unsafe blanket write access.

    developer.wordpress.org
  3. 03
    5

    WordPress Application Passwords

    Issue revocable per-application credentials for authenticated API access without sharing account passwords.

    developer.wordpress.org
  4. 04
    5

    WordPress Two-Factor Plugin

    Add and test maintained two-factor providers built by WordPress contributors.

    wordpress.org
  5. 05
    5

    Cloudflare WAF

    Use managed and custom edge rules as one layer in a broader WordPress defense.

    developers.cloudflare.com
  6. 06
    5

    Mozilla TLS Configuration

    Generate and review modern TLS server configurations for common web servers.

    ssl-config.mozilla.org
  7. 07
    5

    WordPress Monitoring

    The official WordPress overview of file, traffic, behavior, and integrity signals worth watching.

    developer.wordpress.org