Securing WordPress: Login, wp-config.php, Backups and More
WordPress is a frequent target for automated attacks – not because the software itself is insecure, but because it runs on millions of sites. Most security risks arise from default configurations nobody has adjusted and from access routes left open. The good news: the most effective measures are not rocket science.
The Login: The Most Common Attack Target
Automated bots try username and password combinations around the clock. Three measures make this attack route practically useless:
- Two-factor authentication (2FA) for all admin accounts
- Login limit: lock the IP after a few failed attempts
- Custom login URL: use a hard-to-guess path instead of
/wp-login.php
Everything with concrete plugin recommendations → Securing the WordPress Login.
wp-config.php: Hardening the Control Centre
wp-config.php is the most important file in your install – and contains more hardening options than most people use. A few lines make a big difference:
DISALLOW_FILE_EDIT– disables the code editor in the backendFORCE_SSL_ADMIN– forces HTTPS for login and backendWP_DEBUG = false– shows no error messages on live sites- Reset security keys – invalidates all open sessions
With a generator for the ready-made configuration → Hardening wp-config.php.
Backups: The Last Line of Defence
No security concept is complete without reliable backups. What counts is not just that backups are created – but that they can actually be restored when it matters.
What a complete backup includes and why the restore test is the most important step → WordPress Backups Done Right.
When It Has Already Happened: Cleaning Up WordPress
Redirects to foreign sites, spam emails, Google warnings – if you spot any of these signs, fast, structured action is critical:
- Take the site offline immediately (maintenance mode) or block access
- Secure a fresh backup (even of the compromised state – for analysis)
- Locate malicious code with a malware scanner
- Clean files, change credentials, close the vulnerability
Full guide → WordPress Hacked? Recognising and Cleaning Up Malware.
What Else Helps
- Keep plugins up to date – most hacks exploit known vulnerabilities in outdated plugins
- Vulnerability monitoring (e.g. Patchstack) – alerts you to new vulnerabilities in installed plugins
- Hosting with active malware scanning – a good host spots many attacks before they cause damage
- Fewer admin accounts – the fewer accounts with full rights, the smaller the attack surface
The Short Checklist
If you just want a list to work through:
- 2FA enabled for all admins
- Login limit against brute force active
- Default “admin” user removed, strong passwords set
- wp-config.php hardened (file editor off, keys reset)
- Tested backups with an external copy
- Core, plugins, themes and PHP up to date
- Vulnerability monitoring active
What WordPress Security Isn’t
Security isn’t a state you set up once and tick off, but a process. A single security plugin you install and forget lulls you into false security: it protects the login, but keeps no plugins current and tests no backups. And more isn’t more – several security plugins in parallel interfere with each other and make troubleshooting harder. The most effective protection is the combination of clean configuration, ongoing updates and tested backups, as part of any WordPress maintenance.
Related Topics
- Fixing WordPress Errors – Troubleshooting overview for WSOD, 500 errors, and database problems
- Core Web Vitals for WordPress – Improve load times and user experience
- What WordPress Maintenance Really Covers – Prevention rather than repair
Want to know how secure your WordPress site really is? Drop us a line – we will review the configuration and tell you where the biggest action is needed.
Frequently Asked Questions
How do I secure my WordPress site?
In four layers: secure the login (two-factor, login limit), harden wp-config.php (file editor off, force HTTPS, new keys), set up reliable and tested backups, and keep everything up to date. No single plugin does all of this; it's the combination of these layers that lets the most common automated attacks run into nothing.
Is WordPress insecure?
No. WordPress itself is solidly built. The reason it's attacked so often is its reach: it runs on millions of sites, which makes it a worthwhile mass target. Most successful attacks don't exploit the core but outdated plugins, weak passwords and default configurations nobody adjusted – exactly the places that can be secured.
Is a security plugin enough for WordPress security?
A good security plugin is an important building block, but no substitute for ongoing upkeep. It helps with login protection and monitoring, but can neither keep outdated plugins current nor replace tested backups. Several security plugins at once are even counterproductive, because they interfere with each other. Security is a process of configuration, updates and backups – not a single installation.
What is the most important WordPress security measure?
If you can name only one: updates. Most hacks exploit known vulnerabilities in outdated plugins, themes or core versions for which a patch has long existed. Updating promptly closes exactly the holes that the bulk of automated attacks run through – complemented by a secured login and tested backups.
Related Services
Founder & Full-Stack Developer
20+ years of web development experience. Specialised in Laravel, WordPress and custom software for mid-sized businesses.