Anthony IT SolutionsAnthony IT SolutionsHigh quality hosting service
My Account|| [email protected]
Intermediate 19 min

Secure WordPress on web hosting

Harden WordPress: updates, 2FA, connection limitation, wp-config, backups and HTTPS mandatory.

#Security#WordPress#Piratage#Sauvegarde

Ready to start your service? Check offers and order online.

View offers and order

Secure WordPress on web hosting

WordPress represents a majority of sites on web hosting Mutualized and attracts automated attacks. This guide hardens your WordPress installation at Anthony IT Solutions without compromising performance.

Combine good panel practices (SSL, SFTP, backups), WordPress configuration and lightweight security plugins for a resilient site.

In summary mandatory HTTPS, strong accounts, regular updates, limit xmlrpc, automatic backups.

What you need

Basic hardening

  1. HTTPS

    Forcing HTTPS all over the site.

  2. Identifier

    Single entry; no admin ; passwords 16+ characters.

  3. Updates

    Core, themes, plugins, weekly minimum.

  4. Remove

    Unused themes/plugins; obsolete user accounts.

wp-config.php

  1. Salt keys

    Regenerate on api.wordpress.org if compromised.

  2. DISALLOW_FILE_EDIT

    define('DISALLOW_FILE_EDIT', true); blocks the admin file editor.

  3. Debug off

    WP_DEBUG false in production.

  4. Prefix tables

    Change wp_ at the installation (difficult migration after).

Limiting attack vectors

  1. xmlrpc.php

    Disable if unused, htaccess.

  2. wp-login

    Limit attempts (plugin or Cloudflare).

  3. REST API

    Restrict if showcase site without public API.

  4. Listing

    Options -Indexes in .htaccess.

Recommended Safety Plugins

  • Wordfence or Solid Security, light scan
  • No duplicate with LSCWP cache, cache
  • 2FA on admin accounts
  • Journaling failed connections

Permissions and SFTP

  • **Monitoring**, see detailed procedures.
  1. Files 644

    Records 755, no 777.

  2. wp-config

    440 or 644 depending on the host.

  3. Uploads

    Do not check for PHP executable in uploads.

  4. SFTP

    SFTP, dedicated account, not shared.

Backdoors After compromise: restore Save clean and change all passwords.

Troubleshooting

  • Brute-force login, 2FA + IP limit.
  • Malware uploads, MIME types, scan, not PHP in uploads.
  • Plugin vulnerable, MAJ or replacement.
  • Site disfigured, Restore backup; forensic analysis.

Frequently Asked Questions

Wordfence slows down?
Configure night scan; LiteSpeed compatible.

Hide wp-admin?
Posible via plugin; lockout risk, backup access.

SSL is enough?
No, encryption

Hosting mutualized secure?
Yes with WordPress hygiene; isolation counts per client.

Related guides

See also our web hosting offer and all the procedures on wiki web hosting.