Hardening is a set of changes that make a WordPress site harder to break into and quicker to recover. We follow the WordPress project's own hardening guide: keep software current, remove what you do not use, protect logins with strong passwords and a second factor, restrict file permissions, protect wp-config.php, turn off dashboard file editing, keep backups, and keep logs.
Why hardening matters on small sites
Small business sites are rarely targeted by name. They are found by automated tools that scan thousands of sites for an outdated plugin, a weak password or an exposed file. Hardening removes the easy wins those tools look for. It does not make a site impossible to attack, but it moves it out of the group that falls to the first attempt.
The Australian Cyber Security Centre's guide for small businesses makes the same point in general terms: turn on automatic updates, turn on multi-factor authentication starting with your most important accounts, back up regularly, and give each user only the access their role needs [2].
What we review and change
| Area | What we check | Basis |
|---|---|---|
| Updates | WordPress core, theme and plugins are current, with automatic updates switched on where they are safe for your site. | The guide says you should always keep up to date with the latest version of WordPress, and notes automatic updates have been available since version 3.7 [1]. |
| Plugins and themes | Unused plugins and themes are deleted, not just deactivated. Everything left comes from a trusted source. | The guide says not to get plugins or themes from untrusted sources and to delete plugins you do not use [1]. |
| Logins | Admin accounts are reviewed, weak or shared passwords replaced, and two-step sign-in enabled for administrators. | The guide recommends strong passwords and enabling two-step authentication [1]. |
| File permissions | Directories and files set to the guide's recommended values, with write access limited to what WordPress needs. | The guide recommends 755 for directories and 644 for files [1]. |
wp-config.php | Readable only by you and the web server, and blocked from web access. | The guide suggests a 400 or 440 permission and denying web access through .htaccess on Apache [1]. |
| Dashboard file editing | The built-in theme and plugin editor is switched off. | The guide gives DISALLOW_FILE_EDIT and notes it will not stop an attacker uploading files [1]. |
| HTTPS | The site and admin area load only over HTTPS. | The guide recommends an encrypted connection for administration [1]. |
| Logging | Login and file change logging switched on, with somewhere sensible for alerts to go. | The guide calls logs your best friend for understanding what is happening on a site [1]. |
A note on automatic updates
WordPress has been able to update its own core files automatically since version 3.7 [1]. Plugins and themes are different. WordPress 5.5, released in August 2020, added controls to switch on automatic updates for each plugin and theme, but they are off by default [3]. We go through them with you and switch on the ones that are low risk. For anything that touches payments or bookings, we prefer updates tested first on a copy, which is part of our maintenance plans.
What we deliberately leave alone
Hardening advice online often includes changes that cause more trouble than they prevent. We avoid renaming the database table prefix on an existing site, hiding the admin area behind obscure addresses that staff then forget, and stacking several security plugins that fight each other. Each of these has its place, but none is a substitute for the basics in the table above.
Extra care for shops and membership sites
Sites that take payments or hold member accounts carry more risk, so hardening goes a little further. We check that card details are handled by the payment provider's own checkout rather than collected on your pages, review which staff roles can see orders and customer records, and make sure order and customer data is included in backups. Updates to payment and membership plugins are scheduled for testing on a copy rather than applied automatically.
After the hardening is done
Hardening is a set of changes made at one point in time. Plugins change, staff come and go, and new features are added, so the protection slowly drifts unless someone checks it. When the work is complete, you receive a written summary of every change, set out so that you or another provider can review it later.
The summary includes:
- each setting changed, where it lives (WordPress, the hosting panel, the domain or a plugin) and why it was changed;
- plugins removed or replaced, with the reason;
- accounts reviewed, and any that were removed or had their role reduced;
- items we recommend but did not change, because they needed your decision or affected how your staff work.
We suggest a short review at least once a year, or whenever the site changes significantly, such as adding a shop or a members area. You can do this yourself with our hardening checklist, or include it in a maintenance plan.
If something stops working after a change, tell us. Some hardening settings can affect older plugins or unusual setups, and part of the job is adjusting them so security and everyday use sit comfortably together.
How the work runs
- We copy the site and record its current settings.
- We review the site and hosting account against the checklist and send you a short list of proposed changes.
- Once you approve, we make the changes in a sensible order, testing the site after each group.
- You receive a report listing every change, how to reverse it if needed, and what to keep doing each month.
If you would rather do some of this yourself, our hardening checklist for small business sites walks through the same steps in plain English.
Questions people ask
Is installing a security plugin the same as hardening?
A security plugin can be part of it, but hardening is mostly configuration: removing what you do not use, updating what you keep, controlling who can log in and how, and limiting what the web server is allowed to change. Some of those steps happen outside WordPress, in the hosting account.
Will hardening break my site?
It can if it is done carelessly, which is why we copy the site first and test after each change. Restricting file permissions, for example, can stop some plugins from writing files they need. We check for that before and after.
Do you change hosting?
Only if you ask. We review the hosting set-up and tell you if something important is missing, such as current PHP versions or separate backups, but moving host is a separate decision.
Sources
Labels show each source's type.
- Hardening WordPress Primary source WordPress developer documentation
- Small business cyber security guide Primary source Australian Cyber Security Centre
- Automatic Plugin Updates in WordPress 5.5 Secondary source Watchful, 11 August 2020