How to Make WordPress Site Secure

Posted On July 4, 2023

Ensuring the security of your WordPress site is crucial to protect it from potential vulnerabilities and threats. With the popularity of WordPress, it becomes a prime target for hackers and malicious attacks. In this guide, we will explore the steps to make your WordPress site more secure.

By following these best practices and maintaining a proactive approach to security, you can significantly reduce the risk of unauthorized access, data breaches, and other security incidents, ensuring the integrity and safety of your WordPress site and its valuable content.

Here are some advanced security tips to enhance the security of your WordPress site:

1) Update your PHP and WordPress Versions.

It is crucial to keep your PHP and WordPress versions up to date to maintain the security of your website. Here’s why:

  1. Security Patches: Updates to PHP and WordPress often include security patches that address vulnerabilities discovered in previous versions. By staying up to date, you ensure that your site has the latest security fixes, reducing the risk of exploitation by attackers.
  2. Bug Fixes: Updates also include bug fixes that improve the overall stability and performance of PHP and WordPress. Resolving these issues can help prevent unexpected errors or malfunctions on your site.
  3. Compatibility: Newer versions of PHP and WordPress are designed to work seamlessly with the latest plugins, themes, and functionalities. By updating, you ensure that your site remains compatible with the latest developments in the WordPress ecosystem.

To update your PHP version, follow these steps:

  1. Check Compatibility: Before upgrading, ensure that your current plugins, themes, and scripts are compatible with the latest PHP version. Incompatible code may break your site.
  2. Backup Your Site: Perform a full backup of your WordPress site, including the files and database. This ensures that you can restore your site if any issues arise during the update process.
  3. Contact Your Hosting Provider: Reach out to your hosting provider to inquire about the available PHP versions and how to upgrade. Some hosting providers offer a simple way to switch PHP versions through their control panel or by contacting support.

To update your WordPress version, follow these steps:

  1. Backup Your Site: As with any significant update, it is crucial to create a backup of your site to safeguard against any potential issues or data loss.
  2. Update via Dashboard: In your WordPress dashboard, go to the Updates section. If a new WordPress version is available, you will see a notification. Click on the “Update Now” button to initiate the update process.
  3. Update Manually: If the automatic update fails or you prefer to update manually, you can download the latest version of WordPress from the official website (wordpress.org). Extract the files and upload them to your site using FTP or the File Manager provided by your hosting provider.

Remember to test your site thoroughly after updating PHP or WordPress to ensure all functionalities are working correctly. Regularly updating both PHP and WordPress versions is an essential part of maintaining a secure and optimized WordPress website.

2) Change the default WordPress login URL

Changing the default WordPress login URL is a useful security measure to protect your website against brute-force attacks and unauthorized access attempts. By modifying the login URL, you make it more challenging for attackers to locate the login page and target it. Here’s how you can change the default WordPress login URL:

  1. Install a Security Plugin: Use a reputable security plugin like “WPS Hide Login” or “iThemes Security” to change the login URL. These plugins provide a user-friendly interface to modify the login URL and handle the necessary redirection.
  2. Install and Activate the Plugin: In your WordPress dashboard, navigate to “Plugins” and click on “Add New.” Search for the security plugin you prefer, install it, and activate it.
  3. Configure the Plugin Settings: Once the plugin is activated, locate its settings either in the “Settings” or “Security” section of your WordPress dashboard. Look for options related to changing the login URL.
  4. Set a Custom Login URL: Enter the desired custom login URL in the plugin settings. Choose a unique URL that is difficult to guess, preferably something unrelated to the default login page.
  5. Save Changes: After setting the custom login URL, save the changes in the plugin settings.
  6. Test the New Login URL: Open a new browser window or tab and enter the custom login URL you set. Make sure it redirects you to the WordPress login page correctly.

By changing the default WordPress login URL, you add an extra layer of security to your website. However, remember to keep a record of the custom login URL as you’ll need it to access the login page in the future.

3) Change the Default WordPress Database Prefix

Changing the default WordPress database prefix is a recommended security practice to protect your WordPress site from SQL injection attacks. By altering the prefix, you make it more difficult for attackers to target your database tables. Here’s how you can change the default WordPress database prefix:

  1. Backup Your Database: Before making any changes, it’s crucial to create a backup of your WordPress database. This ensures that you have a copy of your data in case anything goes wrong during the process.
  2. Access Your WordPress Files: Use FTP or a file manager provided by your hosting provider to access your WordPress installation files.
  3. Locate the wp-config.php File: Look for the wp-config.php file in the root directory of your WordPress installation. This file contains the configuration settings for your WordPress site.
  4. Open wp-config.php: Download the wp-config.php file to your local computer and open it in a text editor.
  5. Locate the Database Table Prefix: In the wp-config.php file, you’ll find a line that defines the database table prefix. By default, it is set to “wp_”. Look for the line that looks like this:
   $table_prefix = 'wp_';
  1. Change the Database Table Prefix: Modify the database table prefix to something unique and less predictable. For example, you can change it to:
   $table_prefix = 'mycustomprefix_';
  1. Save and Upload the File: Save the changes to the wp-config.php file and upload it back to the root directory of your WordPress installation, overwriting the existing file.
  2. Update the Database Tables: Use a database management tool, such as phpMyAdmin or a similar tool provided by your hosting provider, to access your WordPress database. Look for the tables with the old prefix (e.g., “wp_”) and rename them to match the new prefix you defined in the wp-config.php file.
  3. Update wp-config.php: After updating the table names in the database, go back to the wp-config.php file and ensure that the new prefix is correctly defined.

Changing the default WordPress database prefix helps enhance the security of your site by making it harder for attackers to target your database tables. Remember to proceed with caution and always have a backup of your data before making any modifications to your WordPress installation.

4)Disable file editing in the WordPress dashboard.

Disabling file editing in the WordPress dashboard adds an extra layer of security by preventing unauthorized users from modifying your site’s core files directly from the admin area. Here’s how you can disable file editing:

  1. Access Your WordPress Files: Use FTP or a file manager provided by your hosting provider to access your WordPress installation files.
  2. Locate the wp-config.php File: Look for the wp-config.php file in the root directory of your WordPress installation.
  3. Open wp-config.php: Download the wp-config.php file to your local computer and open it in a text editor.
  4. Add the File Editing Disabling Code: Add the following code snippet to the wp-config.php file, just above the line that says “/* That’s all, stop editing! Happy blogging. */”:
   // Disable file editing
   define('DISALLOW_FILE_EDIT', true);

The code defines the constant DISALLOW_FILE_EDIT and sets it to true, disabling the file editing feature.

  1. Save and Upload the File: Save the changes to the wp-config.php file and upload it back to the root directory of your WordPress installation, overwriting the existing file.

After following these steps, the file editing option will be disabled in the WordPress dashboard for all users, including administrators. This prevents any potential unauthorized modifications to your site’s core files, adding an extra layer of security.

Note: Disabling file editing means you won’t be able to edit theme or plugin files directly from the WordPress dashboard. If you need to make modifications to these files, you’ll have to do it via FTP or a file manager.

5) Disable your xmlrpc.php file.

Disabling the xmlrpc.php file in WordPress is a security measure that can help protect your site against certain types of attacks. Here’s how you can disable the xmlrpc.php file:

  1. Use a Security Plugin: One of the easiest ways to disable xmlrpc.php is by using a security plugin. There are several WordPress security plugins available that provide an option to disable or block xmlrpc.php. Install a reputable security plugin like Wordfence, iThemes Security, or Sucuri Security, and look for the xmlrpc.php blocking feature in the plugin’s settings.
  2. Manual Method: If you prefer a manual approach, you can disable xmlrpc.php by adding some code to your site’s .htaccess file. Follow these steps: a. Access Your WordPress Files: Use FTP or a file manager provided by your hosting provider to access your WordPress installation files. b. Locate the .htaccess File: Look for the .htaccess file in the root directory of your WordPress installation. If you can’t find it, make sure to enable the option to show hidden files. c. Open .htaccess: Download the .htaccess file to your local computer and open it in a text editor. d. Add the Code: Add the following code snippet to the .htaccess file:
  3. # Block access to xmlrpc.php <Files xmlrpc.php> Order Deny,Allow Deny from all </Files>
  4. Save and Upload the File: Save the changes to the .htaccess file and upload it back to the root directory of your WordPress installation, overwriting the existing file.

After following these steps, access to the xmlrpc.php file will be blocked, preventing any potential exploits or attacks targeting that file. Note that some plugins and services may rely on xmlrpc.php functionality, so make sure to test your site thoroughly after disabling it to ensure all desired functionality is still intact.

6) Delete the default WordPress admin account

Deleting the default WordPress admin account is a good security practice to protect your site from unauthorized access. However, instead of deleting the admin account directly, it is recommended to follow these steps to ensure a smooth transition:

  1. Create a New Administrator Account: Log in to your WordPress dashboard using the default admin account. Navigate to “Users” and click on “Add New.” Create a new user with the role of Administrator and provide a unique username and a strong password. Make sure to use a different email address from the default admin account.
  2. Log out and Log in with the New Administrator Account: Log out of your WordPress dashboard and then log in again using the credentials of the newly created Administrator account. This step ensures that the new account has the necessary privileges and access.
  3. Transfer Content and Settings: Before deleting the default admin account, ensure that all necessary content and settings are transferred to the new Administrator account. This includes posts, pages, customizations, and any other configurations associated with the default admin account.
  4. Reassign Authorship: If the default admin account has created posts or pages, you need to reassign authorship to the new Administrator account. This can be done by editing each post or page and changing the author to the new account.
  5. Verify the New Administrator Account: Once you have transferred all necessary content and settings, logged in with the new Administrator account, and verified that everything is functioning as expected, you can proceed to delete the default admin account.
  6. Delete the Default Admin Account: Go to the “Users” section in your WordPress dashboard and locate the default admin account. Hover over it and click on the “Delete” option. Confirm the deletion when prompted.

By following these steps, you can effectively remove the default admin account and enhance the security of your WordPress site. Remember to keep a backup of your site before making any significant changes, and always use strong and unique passwords for all user accounts.

7) Consider hiding your WordPress version

Hiding the WordPress version can be an effective security measure to protect your site from potential attacks. By hiding the version information, you make it more difficult for malicious actors to exploit vulnerabilities specific to a particular WordPress version. Here’s how you can hide the WordPress version:

  1. Update to the Latest WordPress Version: Before proceeding, ensure that your WordPress installation is up to date. Always use the latest stable version, as it includes security patches and bug fixes.
  2. Remove WordPress Version from the HTML Source Code: You can modify the functions.php file of your active theme to remove the WordPress version from the HTML source code. Open the file in a text editor and add the following code:
function remove_wp_version() {
    return '';
}
add_filter('the_generator', 'remove_wp_version');

This code hooks into the the_generator filter and replaces the WordPress version with an empty string.

  1. Use a Security Plugin: Another option is to use a security plugin that offers features to hide the WordPress version. Many security plugins provide an option to remove or obfuscate the version information. Install a reputable security plugin, such as “Wordfence” or “Sucuri,” and explore its settings to enable the feature.
  2. Test and Verify: After implementing the changes, clear your site’s cache and test to ensure that the WordPress version is no longer visible in the HTML source code or other areas where it was previously displayed.

Remember to regularly update your WordPress installation and plugins to maintain a secure website. Additionally, consider implementing other security measures like strong passwords, two-factor authentication, and regular backups to further protect your WordPress site.


In conclusion, securing your WordPress site is crucial to protect it from potential threats and attacks.

Related Posts

About The Author

Blashzon

Add a Comment

Your email address will not be published. Required fields are marked *