Security & SSL
Harden Your WordPress Security
Plugins, login limits, 2FA, and file permission best practices.
5 min read
Essentials
- Install Wordfence or Solid Security (free tier is enough).
- Enable two-factor authentication for all admin users.
- Limit login attempts to 5 per IP per hour.
- Rename /wp-admin login URL via WPS Hide Login.
- Force strong passwords for all users.
- Disable file editing inside the admin: define('DISALLOW_FILE_EDIT', true); in wp-config.php.
- Set folder permissions to 755 and file permissions to 644.
- Keep WordPress core, themes and plugins updated weekly.