Apply these hardening constants to wp-config.php and rules to .htaccess on every production WordPress site.
wp-config.php Constants
// Disable file editing from WordPress admin
define('DISALLOW_FILE_EDIT', true);
// Disable plugin/theme installation
define('DISALLOW_FILE_MODS', true);
// Force SSL for admin area
define('FORCE_SSL_ADMIN', true);
// Hide WordPress version
remove_action('wp_head', 'wp_generator');
// Limit post revisions
define('WP_POST_REVISIONS', 5);
// Increase memory limits
define('WP_MEMORY_LIMIT', '256M');
define('WP_MAX_MEMORY_LIMIT', '512M');
Regenerate Security Keys
Generate fresh salts at https://api.wordpress.org/secret-key/1.1/salt/ and paste into wp-config.php. Regenerate after any suspected compromise.
.htaccess Rules
# Protect wp-config.php
<files wp-config.php>
order allow,deny
deny from all
</files>
# Protect .htaccess
<files .htaccess>
order allow,deny
deny from all
</files>
# Disable directory browsing
Options -Indexes
# Force HTTPS
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
Plugin Recommendations
| Need | Plugin | |------|--------| | Firewall + brute force | Wordfence | | Login URL change | WPS Hide Login | | Full audit + WAF | Sucuri | | Integrity scanning | WP Cerber |
Run Wordfence scan after applying hardening to confirm no residual issues.