What You Should Do First for Basic Security WordPress

For strong WordPress security, you should focus on the most critical steps first. Below is a priority-based approach to securing your WordPress site.

🔒 Must-Do for Basic WordPress Security (Top Priorities)

These are essential and should be done immediately for a secure WordPress setup.

1. Change Default Administrator Username

• If your admin username is admin, change it.
• Create a new admin user, log in with it, and delete the old one.

2. Use Strong Passwords & Two-Factor Authentication (2FA)

• Use unique, long passwords (16+ characters) for admin, hosting, database, and FTP.
• Enable 2FA using plugins like:
  • Google Authenticator
  • Wordfence
  • iThemes Security

3. Keep WordPress, Plugins, and Themes Updated

• Enable automatic updates for WordPress core and plugins.
• Delete unused plugins/themes.

4. Disable File Editing in WordPress Dashboard

Prevents hackers from modifying files via WordPress.

🔹 Add this to wp-config.php:

define('DISALLOW_FILE_EDIT', true);

5. Block Access to wp-config.php

Prevents direct access to your database settings.

🔹 Add this to .htaccess (for Apache):

<Files wp-config.php>
    Order Allow,Deny
    Deny from all
</Files>

For Nginx:

location ~* wp-config.php {
    deny all;
}

6. Block Directory Browsing

Prevents users from seeing your folder structure.

🔹 Add this to .htaccess:

Options -Indexes

7. Limit Login Attempts (Basic WordPress Security)

• Install Limit Login Attempts Reloaded or Wordfence to block brute-force attacks.

Here’s a basic, lightweight “Limit Login Attempts” you can drop into functions.php or (better) an MU-plugin. It limits by IP + username, locks out for a period, and resets on successful login.

✅ Works for normal wp-login form + XML-RPC login attempts (because it hooks into authenticate).

<?php
/**
 * Basic Limit Login Attempts (IP + username)
 * Drop into functions.php OR (recommended) /wp-content/mu-plugins/limit-login-attempts-basic.php
 */

if ( ! defined('ABSPATH') ) exit;

function tb_lla_settings(): array {
    return [
        'max_attempts'     => 5,          // allowed fails before lock
        'window_seconds'   => 15 * 60,     // rolling window (15 min)
        'lockout_seconds'  => 30 * 60,     // lockout duration (30 min)
        'allowlist_ips'    => [ '127.0.0.1', '::1' ], // add your own IP(s)
        'message_prefix'   => 'Security: ',
    ];
}

function tb_lla_get_ip(): string {
    // Basic IP detection; behind Cloudflare/proxy you may want to adapt this.
    $ip = $_SERVER['REMOTE_ADDR'] ?? '';
    return (is_string($ip) && $ip !== '') ? $ip : 'unknown';
}

function tb_lla_key(string $ip, string $user): string {
    $user = strtolower(trim($user));
    return 'tb_lla_' . md5($ip . '|' . $user);
}

function tb_lla_is_allowed_ip(string $ip): bool {
    $s = tb_lla_settings();
    return in_array($ip, $s['allowlist_ips'], true);
}

function tb_lla_get_state(string $ip, string $user): array {
    $key   = tb_lla_key($ip, $user);
    $state = get_transient($key);
    if ( ! is_array($state) ) {
        $state = [
            'fails'        => 0,
            'first_fail'   => 0,
            'locked_until' => 0,
        ];
    }
    return $state;
}

function tb_lla_save_state(string $ip, string $user, array $state, int $ttl): void {
    set_transient(tb_lla_key($ip, $user), $state, max(60, $ttl));
}

function tb_lla_reset(string $ip, string $user): void {
    delete_transient(tb_lla_key($ip, $user));
}

/**
 * Block authentication if locked.
 */
add_filter('authenticate', function($user, $username, $password) {
    $s  = tb_lla_settings();
    $ip = tb_lla_get_ip();

    if ( tb_lla_is_allowed_ip($ip) ) return $user;

    $username = is_string($username) ? $username : '';
    if ( $username === '' ) return $user; // nothing to track

    $state = tb_lla_get_state($ip, $username);
    $now   = time();

    if ( ! empty($state['locked_until']) && $state['locked_until'] > $now ) {
        $remaining = $state['locked_until'] - $now;
        return new WP_Error(
            'tb_lla_locked',
            $s['message_prefix'] . 'Too many login attempts. Try again in ' . gmdate('i:s', $remaining) . ' minutes.'
        );
    }

    return $user;
}, 20, 3);

/**
 * On failed login, increase counters (by IP + username).
 */
add_action('wp_login_failed', function($username) {
    $s  = tb_lla_settings();
    $ip = tb_lla_get_ip();

    if ( tb_lla_is_allowed_ip($ip) ) return;

    $username = is_string($username) ? $username : '';
    if ( $username === '' ) return;

    $state = tb_lla_get_state($ip, $username);
    $now   = time();

    // Reset window if too old
    if ( empty($state['first_fail']) || ($now - (int)$state['first_fail']) > $s['window_seconds'] ) {
        $state['fails']      = 0;
        $state['first_fail'] = $now;
    }

    $state['fails'] = (int)$state['fails'] + 1;

    // Lock if exceeded
    if ( $state['fails'] >= $s['max_attempts'] ) {
        $state['locked_until'] = $now + $s['lockout_seconds'];
        $ttl = $s['lockout_seconds'];
    } else {
        // Keep state at least for the remaining window
        $ttl = max(60, ($s['window_seconds'] - ($now - (int)$state['first_fail'])));
    }

    tb_lla_save_state($ip, $username, $state, $ttl);
}, 10, 1);

/**
 * On successful login, reset attempts for that IP+username.
 */
add_action('wp_login', function($user_login, $user) {
    $ip = tb_lla_get_ip();
    if ( ! is_string($user_login) || $user_login === '' ) return;
    tb_lla_reset($ip, $user_login);
}, 10, 2);

Optional quick upgrades (still “basic”)

• Add your home IP to allowlist_ips.
• If you’re behind Cloudflare, tell me and I’ll swap tb_lla_get_ip() to safely read CF-Connecting-IP.
• Want it to also limit by IP-only (not just per-username)? I can extend it in the same lightweight style.

8. Install a Security Plugin

• Use one of these for automated security protection:
  • Wordfence (best for firewall & malware scanning)
  • iThemes Security
  • Sucuri Security (great for website monitoring)

⚠️ Important for Enhanced Security

These steps add an extra layer of protection and should be applied if possible.

9. Disable XML-RPC (Unless Needed)

Hackers use xmlrpc.php for brute-force attacks.

🔹 Add this to .htaccess:

<Files xmlrpc.php>
    Order Allow,Deny
    Deny from all
</Files>

🔹 Add this to wp-config.php:

Clean and effective way to disable XML-RPC at wp-config.php level 👇
(No plugin, zero overhead)

✅ Disable XML-RPC globally (recommended)

Add this above /* That's all, stop editing! */ in wp-config.php:

define('XMLRPC_REQUEST', false);

➡️ This hard-blocks all XML-RPC requests before WordPress even loads.

🔒 Extra-safe fallback (blocks even if WP loads)

If you want double protection, add this too (still in wp-config.php):

if (isset($_SERVER['REQUEST_URI']) && strpos($_SERVER['REQUEST_URI'], 'xmlrpc.php') !== false) {
    header('HTTP/1.1 403 Forbidden');
    exit('XML-RPC is disabled.');
}

This kills direct access to xmlrpc.php instantly.

⚠️ When NOT to disable XML-RPC

Keep XML-RPC enabled if you use:

• Jetpack (stats, backups, sync)
• WordPress mobile app
• External publishing tools (old-school)
• Some remote cron systems

If none of these apply → disable it without mercy.

🧠 Best Practice (Tokyo Blade Edition™)

10. Change Default Database Table Prefix

Avoid using wp_ as the default prefix.

1. Change it in wp-config.php: $table_prefix = 'custom_';
2. Use iThemes Security to rename database tables.

11. Enable a Web Application Firewall (WAF)

• Cloudflare Free Plan protects against bots and DDoS.
• Wordfence Firewall adds application-level protection.

12. Block Execution of PHP in wp-content/uploads

Malware often hides here.

🔹 Create an .htaccess file inside wp-content/uploads/:

<FilesMatch "\.php$">
    deny from all
</FilesMatch>

13. Enable Bot Protection

🔹 Block bad bots using .htaccess:

RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} ^.*(bot|crawler|spider|wget|curl|scraper).* [NC]
RewriteRule .* - [F,L]

🚀 Advanced Security (Basic WordPress Security Extra Hardening)

If you want maximum protection, apply these too.

14. Disable PHP Execution in Cache Directories

🔹 Create an .htaccess file inside /wp-content/cache/:

<FilesMatch "\.php$">
    deny from all
</FilesMatch>

15. Block Access to .htaccess and .htpasswd

🔹 Add this to .htaccess:

<FilesMatch "^\.ht">
    Order Allow,Deny
    Deny from all
</FilesMatch>

16. Block Author Scans

Prevents hackers from finding usernames.

🔹 Add to .htaccess:

RewriteEngine On
RewriteCond %{QUERY_STRING} author=\d
RewriteRule ^ - [F]

17. Configure Strong Security Keys

Go to this link and replace existing keys in wp-config.php:

define('AUTH_KEY', 'your-new-key');
define('SECURE_AUTH_KEY', 'your-new-key');
define('LOGGED_IN_KEY', 'your-new-key');
define('NONCE_KEY', 'your-new-key');

18. Move wp-config.php One Level Up

If your hosting allows it, move wp-config.php outside the public folder (public_html).

1. Move wp-config.php one level up from your root folder.
2. Add this to index.php: require_once(dirname(__FILE__) . '/../wp-config.php');

19. For Maximum Basic WordPress Security Use SSL & HTTPS

• Get an SSL certificate (many hosts offer free SSL).
• Force HTTPS with a plugin like Really Simple SSL.

💯 Summary: What You Should Do First

✅ Critical (Do these immediately)

• Change admin username & use strong passwords.
• Install Wordfence or iThemes Security.
• Disable file editing in wp-config.php.
• Block directory browsing.
• Limit login attempts.
• Keep WordPress & plugins updated.

⚠️ Recommended for More Security

• Disable XML-RPC.
• Change database prefix.
• Enable Cloudflare WAF.
• Block PHP execution in uploads/ and cache/.
• Use SSL & HTTPS

🚀 Advanced (For Maximum Protection)

• Move wp-config.php one level up.
• Block .htaccess access.
• Block author scans.

📌 Want Full Automation?

You can use iThemes Security Pro or Wordfence Premium to handle many of these automatically.

Let me know if you need help implementing any of these! 🚀🔥