---
title: Security hardening
canonical: https://wpsecurityninja.com/dictionary/security-hardening/
---
# Security hardening

Hardening is the set of configuration and process changes that make a site harder to abuse.

[Full guide](https://wpsecurityninja.com/wordpress-security-hardening-guide/)

## Why it matters for WordPress

Default WordPress is usable, not maximally strict. Hardening shrinks what attackers can touch: fewer plugins, tighter roles, locked file editing, current software, tested backups. It is different from security theater (rename the login URL and call it done).

## How it shows up in practice

- `DISALLOW_FILE_EDIT` so themes are not edited from the dashboard
- XML-RPC or unused REST surfaces restricted
- HTTPS done properly, security headers where they help
- A short plugin list and a restore you have actually tried once

## What to do

1. Start with updates, strong admin hygiene, and a backup you have restored.
2. Remove unused themes and plugins.
3. Harden roles and login before exotic obscurity tricks.
4. Document what you changed so the next developer does not undo it blindly.

Guide: [WordPress security hardening](https://wpsecurityninja.com/wordpress-security-hardening-guide/).