WordPress Hardening Basics

WordPress powers a huge share of the web, which also makes it a constant target for automated attacks. Most successful attacks exploit a handful of avoidable weaknesses — weak logins, outdated plugins, and loose file permissions. These steps cover the highest-impact fixes.

Lock down logins

• Never use "admin" as a username — create a unique administrator account and delete or demote the default one
• Use long, unique passwords — a password manager makes this painless
• Enable two-factor authentication with a plugin like WP 2FA or Wordfence
• Limit login attempts to block brute-force scripts hammering wp-login.php with password guesses

Keep everything updated

The majority of WordPress hacks exploit known vulnerabilities in outdated plugins or themes, not WordPress core itself. Turn on automatic updates for plugins and themes where you can, remove any plugin or theme you're no longer actively using (deactivated is not enough — delete it), and check the Updates screen in wp-admin regularly if you keep auto-updates off for specific plugins.

Set correct file and folder permissions

• Folders should be set to 755 and files to 644 — this is the standard, safe baseline
• wp-config.php should be 600 or 640 — it contains your database credentials and should never be world-readable
• Never set permissions to 777 "just to fix an upload error" — find and fix the actual ownership issue instead, usually via cPanel File Manager's permissions tool

A few more high-value steps

• Disable file editing from wp-admin by adding define('DISALLOW_FILE_EDIT', true); to wp-config.php
• Keep automated backups running (enabled by default on Hoststack) so you can recover quickly if something does get through
• Install a security plugin (Wordfence or Sucuri) for malware scanning and a basic application firewall
• Remove unused themes and demo/placeholder content that ships with some installers