Securing your site comes down to a short list of habits: keep core, themes and plugins updated, install only from trusted sources, pair a strong password with two-step authentication, connect over SFTP, tighten file permissions, set DISALLOW_FILE_EDIT and add a firewall. None of it removes risk completely. It lowers it, and that's the realistic goal.
WordPress's own hardening handbook frames security as risk reduction, not risk elimination. That's a helpful way to think about it. You're not building a wall nobody can climb; you're closing the easy doors, one at a time.
Every step below comes from that guidance, so it pays to get ready first.
Before you start hardening anything
- A recent copy of your site you can restore. Our site backup walkthrough gets that sorted first.
- Admin access to the dashboard, so you can update and delete plugins.
- Your server login details, and an answer from your host on whether it offers SFTP.
- A way to create a strong, unique password, such as a password manager.
- A two-factor plugin or a single sign-on option picked out, because WordPress core doesn't include 2FA.
Eight hardening steps to work through
- Update core to the latest version.
- Install plugins and themes only from the WordPress.org repository or well known companies.
- Update the plugins you keep and delete any you don't use.
- Set a strong password and turn on two-step authentication.
- Connect to your server with SFTP if your host provides it.
- Set directory permissions to 755 and file permissions to 644.
- Add
define( 'DISALLOW_FILE_EDIT', true );to wp-config.php. - Add a firewall: a plugin, a server WAF or a reverse-proxy service.
Steps one to four happen inside the dashboard or your account settings. Steps six and seven edit files on the server, and step five is how you connect to it, through your SFTP client. Where step eight lives depends on which kind of firewall you choose.
What changes once each step is done
It helps to know what each step buys you, so you can explain it to whoever else has a login to your site.
Updates close known holes
Older versions of WordPress aren't maintained with security updates. Running one means any weakness fixed since then stays open on your site. Plugins are the same story, which is why updating them comes paired with deleting the ones you don't use: a plugin you've forgotten about is one you've stopped updating. Our guide on updating your site safely covers the order to do it in.
Trusted sources cut the risk at install time
Sticking to the official repository or well known companies means you're not installing code from an unknown source. It's the easiest step on the list: it only asks you to say no to a download.
Two-step login protects the front door
Two-step authentication adds a second check on top of a strong password. Because WordPress doesn't ship 2FA, you'll add it with a plugin or single sign-on.
SFTP and permissions protect the files
With SFTP, your password is encrypted on its way to the server instead of travelling in plain text. The 755 and 644 permissions, the values in the official example commands, keep directories and files from being more open than they need to be.
DISALLOW_FILE_EDIT and a firewall limit the damage
The DISALLOW_FILE_EDIT line turns off the Dashboard file editor for every user, so a stolen admin login can't be used to edit theme or plugin code from inside the dashboard. A firewall filters bad traffic, whether it runs as a plugin, on the server or as a reverse-proxy service in front of the site.
The catch: one setting people trust too much
DISALLOW_FILE_EDIT is a good line to add, but it won't stop an attacker from uploading malicious files to your site. The handbook says it might stop some attacks. That's all. It closes one door, the built-in editor, and leaves the others exactly as they were.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
That's why it sits in a list rather than on its own. Updates, trusted sources, two-step login, SFTP and permissions each close a different door, and the firewall watches the ones that are left. Skip the rest and DISALLOW_FILE_EDIT gives you a feeling of safety rather than much real protection.
For what your host does and doesn't handle, our piece on where your host's security stops picks up from here.
As of Nov 2026, the hardening steps covered here come from the WordPress developer documentation.
Frequently asked questions
Is it safe to keep a plugin I've deactivated but might use later?
The handbook's advice is to delete any plugin you aren't using rather than leave it sitting there. You can reinstall it from a trusted source when you need it.
Do I need SFTP if my host only offers FTP?
SFTP is the one to use when your host provides it, because it encrypts your password on the way to the server.
Which kind of firewall should I choose?
Any of the three works in principle: a plugin, a WAF on the server or a reverse-proxy service. Pick the one your setup and host can support.
Does WordPress come with two-factor login built in?
No. Two-factor login isn't part of core, so you'll need an add-on or an SSO service for it.
Where do I get plugins and themes safely?
The official WordPress.org directory is the main safe place, and established names are the other. Skip downloads you can't vouch for.
