Securing a WordPress site: 7 essential settings, no heavy plugin required

1. Update everything, and remove what’s no longer used

The WordPress core, the theme and the plugins all need to stay up to date. A plugin is a bit like an app you add to your phone. If you never update it, the known holes stay open. On the Plugins page, I switch on automatic updates for the ones whose developer I know and trust. For the others, I drop by the Updates page regularly.

The part people tend to forget is the tidying up. A theme or plugin that’s deactivated but still installed is still a way in, even if it doesn’t show anywhere. On this site, moving from Elementor to native blocks let me delete everything that had grown up around the page builder. The fewer moving parts, the fewer things there are to keep an eye on.

2. Official, licensed plugins, or nothing

Now and then someone asks me to install a premium plugin picked up “elsewhere” to save on the licence. I say no, and I explain why. A copy that doesn’t come from the developer gets no security fixes, and it sometimes carries malicious code slipped in by whoever redistributed it. The risk isn’t theoretical. If the budget won’t stretch to the licence, it’s better to look for a free alternative that’s maintained, with recent updates in the official directory.

3. Don’t hand the attacker your username

By default, WordPress publishes the list of the site’s user accounts at a technical address anyone can look up, and the author archives show the login name as well. In other words, someone trying to force their way in already holds half the secret. All that’s left is guessing the password.

So I block that list for visitors who aren’t logged in, and I disable the author archives. Depending on the SEO plugin in place, it’s often a single tick box. The principle is simple. An attacker who doesn’t know the username has two things to find instead of one.

4. A passphrase, and two-factor authentication

Most attacks on the login page are automated. A bot tries thousands of common passwords, one after another. Against that, a password manager and a long passphrase are enough to neutralise the vast majority of attempts. Two-factor authentication (a code on your phone on top of the password) adds a second lock. It takes five minutes to set up and it makes all the difference the day a password leaks somewhere else.

5. Security headers, or instructions handed to the browser

Every time a browser loads a page, the server can slip it a few instructions. Don’t let this site be displayed inside a frame on another site, which prevents clickjacking. Don’t treat a file as anything other than what it claims to be. Limit what gets passed on to third-party sites when someone clicks a link. Insist on HTTPS once and for all, when the whole site is encrypted.

Those are the HTTP security headers. On this site, I added them in the server-side configuration, which takes a few lines. The trap is being too strict and breaking an embedded video or a preview somewhere. I prefer to start cautious, test the site page by page, then tighten up.

6. Hide what has no business being public

A fresh WordPress install leaves a few things lying around that are of no use to visitors and of real use to the curious. A readme page that gives away the installed version. Directory listing, which lets anyone browse the folder structure like a file explorer. And an old remote-access entry point (xmlrpc), handy ten years ago, now mostly used to test passwords in bulk. When they’re not needed, I block them at server level.

7. Close comments if nobody uses them

Back to those 300 comments in the moderation queue. This site was never meant to host discussions, yet the forms were open. Every spam comment is noise in the dashboard and one more surface to attack. Under Settings → Discussion, I closed comments and pingbacks, then emptied the queue. On a site where the conversation matters, I obviously keep them, with active moderation.

And the day it all goes wrong?

None of these measures replaces a regular backup, stored off the server and, above all, tested. A backup you’ve never tried to restore is just a hope. On this site, UpdraftPlus takes care of it on a fixed schedule, with a copy sent off the server. It’s the only real guarantee of being able to roll back quickly, whatever caused the problem.

These seven settings take under an hour, don’t slow the site down and need no heavy plugin. A full security plugin, with a firewall and a login log, is still worth having on a site with several accounts or heavy traffic. It doesn’t excuse you from the basics, though. It sits on top of them.