WordPress security tips from our tip contest

We ran a security tip contest. Participants sent short, practical advice. Here is the useful core, rewritten without the contest fluff.

Tips worth keeping

Install and configure a security plugin

Scanning, firewall rules, login limits, and event logs only help if you turn them on and review alerts. Setup overview: security plugin setup guide.

Choose hosting with a real security story

Isolation between accounts, malware handling, and competent support beat the cheapest unlimited plan. Hosting is part of security hardening.

Harden logins

Strong unique passwords, two-factor authentication, and brute-force limits matter more than renaming wp-login.php alone. Guide: WordPress login security.

Keep core, themes, and plugins updated

Most mass compromises still start with known holes in outdated software. Weekly update habit, delete what you do not use.

Disable or restrict XML-RPC if you do not need it

xmlrpc.php is a common abuse target for brute-force and pingback noise. If nothing you run needs it, block it at the host, CDN, or security plugin.

Stop PHP execution in uploads

wp-content/uploads should hold media, not executable PHP. Many hosts and security plugins offer “disable PHP in uploads.” Use that.

Headless architecture can reduce some exposure for specialized builds. Most WordPress sites get more value from the checklist above than from a full headless rewrite.

Full baseline: WordPress security checklist and hardening guide.