How to Harden WordPress on a Production Server

A hardened WordPress installation is significantly harder to compromise. This guide covers every security layer from file permissions to login protection.

wp-config.php Hardening

define('DISALLOW_FILE_EDIT', true);
define('DISALLOW_FILE_MODS', true);
define('WP_POST_REVISIONS', 3);
define('WP_DEBUG', false);

File Permissions

find /var/www/html -type f -exec chmod 644 {} \;
find /var/www/html -type d -exec chmod 755 {} \;
chmod 600 /var/www/html/wp-config.php

Nginx Security Rules

location = /xmlrpc.php { deny all; return 404; }
location ~* /wp-content/uploads/.*\.php$ { deny all; }

Monitor for Intrusions

find /var/www/html -newer /var/www/html/wp-config.php -name "*.php" 2>/dev/null | head -20
grep -r "base64_decode" /var/www/html --include="*.php"

Conclusion

WordPress security requires multiple layers. Our team provides comprehensive WordPress security hardening.