Introduction
WordPress powers over 40% of the web, making it the most targeted platform for automated bot scans, brute-force dictionary attacks, and credential stuffing.
Most site owners simply install a bloated security plugin and assume they are protected.
True hardening happens at the server configuration and core framework level, eliminating attack vectors before bots ever reach PHP.
Here are the non-negotiable security steps every professional developer takes.
Disabling XML-RPC and User Enumeration
XML-RPC (xmlrpc.php) is an outdated legacy protocol frequently abused by botnets to launch massive DDoS amplification attacks and test thousands of password guesses in a single request.
Unless you specifically use the official WordPress mobile app or Jetpack, block access to xmlrpc.php completely at the Nginx or .htaccess level.
Block author enumeration scans by redirecting /?author=1 requests and disabling public user listings on /wp-json/wp/v2/users.
Hiding administrative usernames removes 50% of the credentials required for brute-force entry.
Locking Down File Permissions and wp-config.php
Never run files with 777 permissions. Web files should be 644 and directories 755, owned by the web server user.
Protect wp-config.php by moving it one directory above the web root or setting strict 600 or 400 read-only permissions.
Add define('DISALLOW_FILE_EDIT', true); to wp-config.php to disable the built-in theme and plugin code editor in the admin panel.
If an admin account is compromised, the attacker cannot inject backdoors directly via the dashboard.
Two-Factor Authentication and Rate Limiting wp-login.php
Enforce Time-based One-Time Password (TOTP) two-factor authentication for all users with Administrator, Editor, or Shop Manager roles.
Deploy Cloudflare WAF rate-limiting rules on /wp-login.php and /xmlrpc.php to restrict repeated failed attempts to 5 per minute per IP.
Enable automatic security updates for minor core patches and actively prune abandoned, unmaintained plugins.
Prevention at the edge keeps malicious traffic from consuming server CPU and bandwidth.
Frequently Asked Questions
Does disabling XML-RPC break my site? — No, modern WordPress operates fully on the REST API; XML-RPC is almost entirely deprecated.
Are free security plugins safe? — Reputable plugins like Wordfence or Sucuri are useful for file scanning, but core server-level hardening is cleaner and faster.
What should I do if my site has already been hacked? — Immediately restore from a clean off-site backup, rotate all passwords and database salts, and update all software.