Methods to protect your WordPress site from breaches

WordPress is a common target because it is common. Most breaches still come from outdated plugins, weak or shared admin passwords, and leftover access, not from exotic zero-days.

This post covers defenses that change real risk. For the longer playbook, use the WordPress security hardening guide and the login security guide.

Keep WordPress, themes, and plugins updated

Unpatched plugins are the usual entry point. Update on a schedule. Delete what you do not use, including deactivated leftovers.

Scan installed software for known issues with a vulnerability scanner. Small sites get attacked too: why “insignificant” sites get hit.

Strong logins and two-factor authentication

Protect wp-admin with unique passwords from a password manager, then add two-factor authentication for every administrator (and anyone who can install plugins).

Limit failed logins and review who has the Administrator role. Details: login security and user roles.

Restrict admin access by IP (when your IP is stable)

If you always manage the site from a fixed office IP, you can deny everyone else at the web server. This fails on home broadband with a changing IP, mobile networks, and travel. Prefer login protection and 2FA when your address moves.

Apache 2.2-style example in the site root .htaccess (replace with your real IP). Put this outside any WordPress rewrite block your host manages, or ask the host to apply an equivalent rule:

<Files wp-login.php>
	Order Deny,Allow
	Deny from all
	Allow from 203.0.113.10
</Files>

Apache 2.4 prefers Require:

<Files wp-login.php>
	Require ip 203.0.113.10
</Files>

Locking down the whole wp-admin directory the same way can break AJAX and plugin admin calls from other IPs. Test on staging first. A Cloud Firewall or host WAF with IP allowlists is often easier to reverse than a broken .htaccess.

Force HTTPS for the admin area

Use HTTPS site-wide (host or Let’s Encrypt). Then force admin over SSL in wp-config.php, above the line that loads wp-settings.php:

define( 'FORCE_SSL_ADMIN', true );

SSL alone does not stop plugin exploits. It stops cleartext admin sessions on hostile networks. Basics: SSL certificates.

Disable TRACE and TRACK

Some Apache setups still allow TRACE/TRACK, which historically helped cross-site tracing attacks. In root .htaccess:

RewriteEngine On
RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK)
RewriteRule .* - [F]

If the host already blocks these methods at the server level, you do not need a duplicate rule.

Reduce username discovery from author archives

Default author archives can leak login names (?author=1). That does not replace a strong password, but it removes an easy first step for brute-force tools.

In a child theme’s functions.php (never edit a parent theme you will overwrite):

add_action( 'template_redirect', 'sn_redirect_author_archives' );
function sn_redirect_author_archives() {
	if ( is_author() ) {
		wp_safe_redirect( home_url( '/' ), 301 );
		exit;
	}
}

Renaming the login URL is optional convenience, not a substitute for 2FA. See login security.

Trim noisy header meta (optional cleanup)

Removing generator tags and old RSD/WLW links does not stop a skilled attacker. It is fine as housekeeping. Broken snippets are worse than leaving the tags alone.

In a child theme functions.php:

remove_action( 'wp_head', 'feed_links_extra', 3 );
remove_action( 'wp_head', 'feed_links', 2 );
remove_action( 'wp_head', 'rsd_link' );
remove_action( 'wp_head', 'wlwmanifest_link' );
remove_action( 'wp_head', 'wp_generator' );
remove_action( 'wp_head', 'adjacent_posts_rel_link_wp_head', 10, 0 );

Hiding the WordPress version in HTML does not replace updates. Attackers probe plugins and known endpoints regardless of the meta generator line.

Choose a host that takes security seriously

A solid host gives you TLS, malware scanning or isolation options, and backups you can actually restore. Pair hosting with application hardening: protect a WordPress website, firewall plugins guide, and offsite backups.

Defenses that matter more than theater

Priority order for most sites:

1. Unique passwords and 2FA on admins
2. Updates and delete unused plugins
3. Offsite backups you have restored once
4. Firewall / login rate limits (Cloud Firewall)
5. Monitoring for mystery files and new admins

You will not make a public site unhackable. You can make opportunistic attacks noisy, expensive, and recoverable. Full checklist: WordPress security hardening guide.