WordPress Hardening Checklist to Secure Your Site

Updated: 22 October 2026 · Applies to: WordPress

Hardening checklist

• Remove every unused plugin and theme, and keep WordPress core, plugins and themes updated.
• Install a security plugin such as Wordfence or iThemes Security (formerly Better WP Security) and work through its setup checklist.
• Change every password that touches the site: WordPress admin, FTP/SSH, cPanel and the WordPress database user.
• Regenerate your WordPress secret keys and salts in wp-config.php. WordPress's own secret-key generator service, linked from the Hardening WordPress guide below, produces a fresh set to paste in.
• Disable the theme editor, which lets an attacker who gets admin access edit PHP files directly:

  define('DISALLOW_FILE_EDIT', true);

  Add that line to wp-config.php.
• Create a new administrator account and delete the default "admin" account, so attackers cannot target a known username.
• Move wp-config.php one directory above the web root where your hosting setup allows it, and set its permissions to 600.
• Rename the wp-admin folder, or restrict access to it by IP using .htaccess:

  Order Deny,Allow
  Deny from all
  Allow from 203.0.113.0/24

  Replace 203.0.113.0/24 with your own office or admin IP range; find your current IP with any search engine query for "what is my IP".
• Change the WordPress table prefix from the default wp_, and see WordPress's own Hardening WordPress guide for more on securing wp-includes.
• Remove readme.html and license.txt from the WordPress root; both can reveal the exact version you are running.

If your site has already been hacked

A common symptom is a widget replaced with an unfamiliar text widget, or the site's character encoding silently switched from UTF-8 to UTF-7.

1. Log in to wp-admin and go to Appearance > Widgets. Delete any unfamiliar text widget and restore your original widgets.
2. Go to Settings > Reading and confirm the character encoding is set back to UTF-8; this also fixes RSS feed issues the hack may have caused.
3. Go to Appearance > Customize (or your theme's settings) and reset the site title and tagline if the hack changed them.
4. Clear any caching plugin or server-side cache and confirm the site looks right again.

With the site restored, secure it so the same attack cannot repeat:

1. Change every password again (hosting account, WordPress, database).
2. Update WordPress, every plugin and every theme to their latest versions.
3. If you have a clean backup from before the attack, consider restoring it instead of patching the live site.
4. Install a security plugin (such as iThemes Security) and work through its findings one by one. Some fixes, like forcing HTTPS, can break existing image or page links; export your content first (Tools > Export) so you have a reference to fix links against afterward.
5. Move wp-config.php up one directory, change the database password, and update both the new password and the secret keys in wp-config.php to match.