WordPress Security Hardening & Audit Checklist
A structured audit framework and configuration template designed to harden production WordPress sites against common exploitation paths.
The Problem
WordPress powers over 40% of the web but is frequently compromised via automated credential stuffing against XML-RPC, REST API user enumeration, and exposed sensitive backup files.
Project Context
Drawing on professional experience in web development and infrastructure, developed a repeatable hardening checklist and server-level ruleset for securing WordPress deployments.
System Architecture & Data Flow
Layered defense approach combining web server directives (.htaccess / Nginx), PHP runtime restrictions, and Cloudflare WAF configurations.
Block public access to xmlrpc.php to prevent automated amplification attacks and brute force.
Disable REST API user enumeration endpoints (/wp-json/wp/v2/users) for unauthenticated visitors.
Restrict execution of PHP files inside /wp-content/uploads/ directory to stop webshell execution.
Protect wp-config.php and sensitive backup files (.sql, .bak, .git) at the web server layer.
Enforce strong authentication via two-factor authentication and strict login attempt throttling.
Technologies & Tools Used
Security Considerations
- •Defense in depth: security applied at DNS/WAF level, web server configuration, and application runtime.
- •Careful exception handling to avoid breaking legitimate e-commerce webhooks and mobile integrations.
Implementation Notes
• Created standardized .htaccess and nginx.conf snippets ready for production deployment.
• Authored audit documentation explaining the specific risk vector mitigated by each rule.
Engineering Challenges
Verified Results
- Applied across multiple production web environments, effectively eliminating automated XML-RPC traffic spikes and webshell drop attempts.
Lessons Learned
- •Most WordPress compromises succeed not through zero-days, but through neglected basics: default endpoints, weak passwords, and permissive directory permissions.