Hardening WordPress Without Locking Yourself Out: A Risk-Sorted Checklist

Most WordPress security advice is a list of switches. The problem is not the list, it is the order: people turn on ten things at once, the login page breaks, and they are locked out of their own site. Here is the checklist I use, sorted by risk, with the commands behind it.

Disclosure: I'm part of the team behind NodeThemes Security AI, a WordPress security plugin. The steps below work with or without it.

The 10 steps, sorted by lock-out risk

Do the top half today. Do the bottom half one item at a time.

The three that lock people out

Login limits behind a proxy. If your site sits behind Cloudflare or a load balancer and the plugin reads REMOTE_ADDR, every visitor has the proxy's IP. Ten failed logins from anyone, and everyone is locked out. Read the IP from the header your proxy sets (CF-Connecting-IP for Cloudflare), and only that header, because any visitor can fake the others.

2FA without a way back. Save the backup codes before you log out. Keep access to your hosting file manager or SFTP: renaming a plugin folder in wp-content/plugins always turns that plugin off.

Hardening rules you never tested. Two classics from the WordPress hardening handbook:

// wp-config.php – no theme/plugin editor in the dashboard
define( 'DISALLOW_FILE_EDIT', true );

# wp-content/uploads/.htaccess (Apache 2.4) – uploaded PHP files cannot run
<FilesMatch "\.(?:php|phtml|phar)$">
    Require all denied
</FilesMatch>

Both are safe on most sites. But on some hosts .htaccess directives cause a 500 error. So after every rule: load the home page, the login page and (for a shop) the checkout. If one fails, remove the rule before you add the next.

Be honest about what a plugin firewall does

A firewall inside WordPress blocks SQL injection, XSS and scanner traffic before your theme and other plugins handle the request. That is useful. It does not stop a large flood of traffic, because the request already reached your server. For that you need your host's firewall or a CDN. A plugin firewall that runs through auto_prepend_file starts earlier and costs less CPU, but it still runs on your server.

Scanners have limits too. Pattern-based malware scans find known backdoors and obvious obfuscation; brand-new malware can slip through. Comparing core files with the official checksums from WordPress.org catches changed files regardless of what is inside them.

How we built this into a plugin

We built NodeThemes Security AI around the "never lock yourself out" idea:

• Administrators are never blocked by the firewall rules.
• Every hardening switch requests your home page and login page right after it is turned on, and turns itself off again if one of them fails.
• define( 'NTSA_SAFE_MODE', true ); in wp-config.php pauses everything; NTSA_DISABLE_2FA turns off two-factor login if you lose your phone.

The free version (GPL, code on GitHub) has the firewall, login limits, 2FA for one account, a core file check and a weekly malware scan. Pro adds the early firewall, 2FA for every user, scheduled scans, alerts and all 11 hardening switches.

The short version

Update, back up, use unique passwords. Then add login limits, 2FA and hardening one at a time, test after each change, and always keep a way back in.

The full checklist, with every step explained, is here: How to secure WordPress without locking yourself out.