How to: Harden a WordPress installation

When to use this guide

Use this guide as part of a periodic WordPress security review, or when any of the following apply:

WordPress core, plugins, or theme have not been updated recently
Unused plugins or themes are installed
The default admin username may be in use
The login page ( wp-login.php ) has no brute-force protection
XML-RPC is enabled but not actively used
No vulnerability scanning is in place

For further background, see: WordPress Security Hardening

How urgent is this? WordPress hardening is high priority. The majority of WordPress compromises exploit known vulnerabilities in outdated plugins or weak login configurations. These are well-documented attack vectors that are actively and routinely exploited.

Who does this?

The person responsible for managing the WordPress installation. This requires access to the WordPress admin dashboard and, for some steps, the hosting control panel.

Background

Risk	Why it matters
Outdated plugins / core	Most WP compromises exploit known vulnerabilities in outdated software
Unused plugins / themes	Inactive plugins are still an attack surface — even if not visible to visitors
Default admin username	The first username attackers try in brute-force attacks
Unprotected login page	wp-login.php is publicly accessible by default and a frequent target
XML-RPC enabled	/xmlrpc.php is a frequent target for brute-force and DDoS amplification attacks

Step 1: Update WordPress core, plugins, and theme

In the WordPress dashboard, go to Dashboard → Updates. Update:

WordPress core
All active plugins
The active theme

Make a backup before updating, especially for major WordPress version upgrades. Most hosting providers (including SiteGround) offer one-click backups.

Enable automatic updates where possible: go to Plugins → installed plugins and enable "Enable auto-updates" for each plugin.

Step 2: Remove unused plugins and themes

Go to Plugins → Installed Plugins and deactivate and delete any plugins that are not actively used. Deactivating alone is not sufficient — inactive plugins are still an attack surface.

Go to Appearance → Themes and delete any themes that are not in use. Keep only the active theme and optionally one default WordPress theme as a fallback.

Step 3: Check the admin username

Go to Users → All Users and check whether a user with the username admin exists.

If it does:

Create a new user with a different username and Administrator role
Log in with the new user
Delete the old admin user, assigning its content to the new user

Apply at least one of the following:

Option A — Two-factor authentication (2FA)

Install a plugin such as WP 2FA or Google Authenticator and require 2FA for all administrator accounts.

Option B — Rate limiting

Most security plugins (Solid Security, Wordfence) include login rate limiting — blocking an IP after a set number of failed attempts.

Option C — Relocate the login URL

Use a plugin like WPS Hide Login to change wp-login.php to a custom URL. This reduces automated attacks significantly.

Combining A and B is recommended.

Step 5: Disable XML-RPC if not needed

XML-RPC (/xmlrpc.php) is a legacy WordPress API. Unless you actively use it (e.g. for the Jetpack plugin or mobile app publishing), disable it.

Add the following to your .htaccess file, or use a security plugin (Solid Security, Wordfence) which includes an XML-RPC disable option:

<Files xmlrpc.php>
  Order Deny,Allow
  Deny from all
</Files>

To check if you use XML-RPC: if you don't use Jetpack, the WordPress mobile app, or any tool that requires it, you can safely disable it.

Step 6: Run WPScan periodically

WPScan scans your WordPress installation for known vulnerabilities in core, plugins, and themes. Run it at the following frequency:

Monthly for sites handling donations, payments, or personal data
Quarterly for informational sites without transactions
Also run it after any significant plugin or core update.

WPScan can be run via their hosted service at wpscan.com or via the command line using an API key (register for free at wpscan.com ):

wpscan --url https://[yourdomain] --api-token YOUR-API-TOKEN

If WPScan reports the site is unavailable or blocking the scan, try one of the following:

Use an API key — register at wpscan.com and include --api-token YOUR-API-TOKEN in the command. Authenticated scans are less likely to be blocked by security plugins or firewalls.
Run from the server — if you have SSH access to the server, run WPScan locally. This bypasses external blocking entirely.
Use Patchstack as an alternative — Patchstack is a WordPress plugin that scans from within the installation. It is free for non-profits and is not affected by external firewalls.

Step 7: Verification

After completing all steps, verify:

Dashboard → Updates shows no pending updates
No unused plugins or themes remain installed
No user with username admin exists
Login page has 2FA and/or rate limiting active
/xmlrpc.php returns a 403 or 404 — test by visiting https://[yourdomain]/xmlrpc.php in a browser
WPScan shows no critical vulnerabilities