Articles / Hardening
WordPress hardening
WordPress hardening means closing the doors a default install leaves open. These articles walk through HTTPS, plugin vulnerabilities and the settings worth changing on every site.
RSS FeedLatest WordPress hardening articles
How to Force HTTPS in WordPress, Step by Step
A calm, ordered way to force HTTPS in WordPress: certificate, URLs, redirects, mixed content, Cloudflare settings and HSTS as the very last step.
Read articleWordPress Plugin Vulnerabilities: What They Are and How to Stay Safe
Most WordPress break-ins start with a plugin or theme, not WordPress itself. Here is how the weak spots work, how fixes reach you, and a calm routine for staying ahead of them.
Read articleWordPress Comment Spam: How to Stop It for Good
Spam comments clutter your site, hurt your search standing and can hide malicious links. Here is how to stop them with core settings, filters, CAPTCHA, or by switching comments off.
Read articleHow to Block Countries in WordPress (and When You Should Not)
Country blocking can cut attack noise for a local business, and it can also lock out real customers. Here is how to block countries in WordPress safely, and when to leave it alone.
Read articleWordPress Salts: What They Do and How to Rotate Them
The eight long random strings in wp-config.php keep your login cookies from being forged. Here is what WordPress salts do, when to change them and how to rotate them by hand or by command.
Read articleGet new articles by email
One short email when a new article is out, plus the WordPress threats worth knowing about. No spam, unsubscribe any time.
Questions
WordPress hardening: questions
What does WordPress hardening mean?
Changing settings and server rules so there is less for an attacker to use: HTTPS everywhere, no file editor, no unused XML-RPC, no username leaks and up-to-date software.
Can WordPress hardening break my site?
A few settings can, such as a strict Content Security Policy or blocking XML-RPC when an app needs it. Change one thing at a time and test the site afterwards.
Does Stack Guard do WordPress hardening for me?
Most of it, with one switch each, and Stack Guard Free includes the core hardening options. Pro adds scheduled key rotation and a few deeper controls.