Outdated plugins and weak settings cause most hacked WordPress sites. Plesk's WP Toolkit brings security hardening and update management for all your WordPress sites into one screen. This guide focuses on those features; installation and basics are in install and manage WordPress with WP Toolkit.
Before you start
- WordPress sites installed or scanned into WP Toolkit (use Scan to find manual installs).
- A backup or restore point before applying major changes.
Apply security measures
- Go to WordPress in the left menu and open the site's card.
- Click Security (the shield icon shows the status).
- Review the list. Recommended measures include:
- Restricting access to
wp-config.phpand other sensitive files. - Disabling PHP execution in cache and upload folders.
- Blocking directory browsing and author scans.
- Changing the default database table prefix.
- Disabling file editing in the WordPress dashboard.
- Turning off XML-RPC if you do not use apps or Jetpack that need it.
- Restricting access to
- Select measures and click Secure. You can revert any measure later.
Apply measures one by one on complex sites and test, because some plugins expect default behaviour.
Automatic updates
On the site card, open Updates → Update settings:
- WordPress core: automatic minor (security) updates at least; major updates on staging first.
- Plugins and themes: enable auto-updates for trusted, well-maintained items, or all of them with Smart Updates enabled.
- Vulnerable plugins: WP Toolkit flags plugins and themes with known vulnerabilities; update or remove them promptly.
Smart Updates
Smart Updates (available in some licences) clones the site, applies updates to the clone, compares screenshots and page content, and only updates the live site if nothing changed visibly. It reduces the risk of broken layouts after automatic updates – useful for client sites you cannot check daily.
Other useful tools
- Maintenance mode while you work on the site.
- Password protection for staging copies; see staging in Plesk.
- Debugging toggles for
WP_DEBUGwithout editing files. - Search engine indexing switch for staging sites.
Server-side protection
Combine WP Toolkit with server protections: Fail2Ban's WordPress jail blocks login attacks (see Fail2Ban in Plesk) and ModSecurity filters common exploits.
Troubleshooting
- Site broke after a security measure: revert that measure in the Security screen.
- Updates fail: file ownership or permissions changed; WP Toolkit's Fix options or support can repair ownership.
- Site missing in WP Toolkit: run Scan; non-standard installs may need to be attached manually.