WordPress security hardening checklist

Most hacked WordPress sites are compromised through outdated plugins, reused passwords or abandoned admin accounts, not through the server. MdmHost servers already run Imunify360 and CloudLinux isolation, but these steps close the holes that only you can close inside WordPress.

Before you start

• Administrator access to WordPress and to cPanel.
• A current backup taken before you change permissions or configuration.

Secure logins

• Check Users → All Users. Remove accounts nobody uses and downgrade people who do not need the Administrator role.
• Give every administrator a unique password of 16+ characters from a password manager.
• Enable two-factor authentication with a plugin such as Two Factor or Wordfence Login Security.
• Never use admin as a username. Create a new admin user, log in as it, and delete the old one, attributing its posts to the new account.

Keep everything updated

Update WordPress core, plugins and themes at least weekly. Delete plugins and themes you are not using, because deactivated code can still be exploited. Keep one default theme such as Twenty Twenty-Five as a fallback.

Lock down wp-config.php

Add these lines to wp-config.php above the "stop editing" comment:

define( 'DISALLOW_FILE_EDIT', true );
define( 'FORCE_SSL_ADMIN', true );

DISALLOW_FILE_EDIT removes the theme and plugin code editors, so a stolen admin session cannot be used to inject PHP. Also make sure your security keys and salts are unique; you can regenerate them from the official WordPress salt generator.

Set correct file permissions

• Folders 755, files 644, and wp-config.php 600 or 640.
• Never use 777. On MdmHost PHP runs as your own user, so WordPress can write files without it.

Protect the login page and XML-RPC

• Limit login attempts with your security plugin. Imunify360 also blocks brute-force attacks at server level.
• Disable XML-RPC if you do not use the mobile app or Jetpack.
• Optionally protect /wp-admin with cPanel → Files → Directory Privacy, adding a second password prompt. Exclude admin-ajax.php if front-end features stop working.

Use HTTPS everywhere

AutoSSL gives every domain a free certificate. Force HTTPS so logins and cookies are never sent in plain text.

Back up and monitor

• MdmHost takes daily JetBackup snapshots. Test a restore of one file now so you know how it works.
• Keep an additional off-site backup for important sites.
• Review cPanel → Security → Imunify360 for detected malware and act on alerts.

Choose plugins and themes carefully

Every plugin adds code that can contain vulnerabilities. Before installing one, check that it was updated in the last few months, has a meaningful number of active installs and supports your WordPress version. Never install "nulled" premium plugins or themes from unofficial sites: they are one of the most common sources of backdoors we see on hacked sites.

Quick security checklist

Repeat this list once a month, or put it in your maintenance calendar if you manage sites for clients.

Next steps

• Clean up a hacked WordPress site
• Disable XML-RPC and protect wp-login
• Set correct WordPress file permissions
• Force HTTPS in WordPress