Guide
WordPress security hardening checklist for small businesses
The security areas we review when making a WordPress site harder to break into.
By Hamza Rivera, updated
Short answer: WordPress hardening covers updates, access, server settings, backups and monitoring. Passieon reviews the site and applies the changes that fit its setup.
What we review
- 1
Updates and unused software
We check WordPress, themes and plugins for updates and remove software the site no longer needs.
- 2
Accounts and access
We review administrator accounts, access roles and authentication, then recommend changes suited to the site.
- 3
Server and file settings
We check permissions, HTTPS and editing controls with the host or developer.
- 4
Backups and monitoring
We check that files and database can be restored, and discuss the monitoring that fits the site.
If the site has already been hacked
- Change every password again after you know the site is clean, not only when you find the hack.
- Reset the secret keys in wp-config.php so anyone who is still logged in is signed out.
- Scan your own computer too. WordPress documentation notes that attacks often begin with malware on the site owner's machine that captures logins.
- Ask your host what they can see and what backups they keep.
Where to read next
Checked against the WordPress developer documentation on November 8, 2026. WordPress changes, so check again if you read this much later.
Questions about WordPress security
Is a security plugin enough?
A good one helps, but it is one layer. Updates, unique passwords, two-step login, removing unused plugins and tested backups do more than any single tool. WordPress documentation lists several scanner plugins and says no one solution is the best approach.
Does DISALLOW_FILE_EDIT make my site safe?
No. WordPress documentation says it will not prevent an attacker from uploading malicious files, but might stop some attacks. It is one cheap step among many.
Should I move wp-config.php above the web root?
WordPress documentation describes it as an option and also says some people argue it has minimal benefit and can introduce problems if done carelessly. Setting strict permissions on the file is the simpler step.
How often should I back up?
WordPress documentation says to back up regularly, including your database. How often depends on how often the site changes. A shop that takes orders needs it more often than a brochure site.
My site was already hacked. Is this enough?
No. Hardening reduces the chance of a repeat after the site is clean. If you see spam pages in Google or a hacked label, start with our guides on removing hacked spam pages and the hacked warning.
Can you harden my site for me?
Yes, as part of a cleanup or on its own. Passieon is an independent agency, not connected to WordPress or Google. Send your site through the form.