Hardening WordPress Without a Plugin: 10 Manual Steps Every Admin Must Know

Summary

Many WordPress site owners depend on security plugins as their sole defense, but this can create a false sense of security. A truly hardened WordPress installation requires manual configurations that no plugin can replace. This article provides 10 concrete, step-by-step hardening measures you can implement immediately without any plugin. From setting correct file permissions to disabling XML-RPC, each step addresses a specific vulnerability. You'll learn how to lock down your wp-config.php, remove directory browsing, and more. Following these steps will significantly reduce your attack surface, even if you continue to use security plugins as an additional layer. By the end, you'll have a manually hardened WordPress site that is far more resilient to common attacks.

Introduction

You've installed a popular security plugin, configured the firewall, and run regular scans. Yet, your WordPress site could still be vulnerable. Security plugins are valuable, but they often miss the low‑hanging fruit that manual hardening catches. Relying solely on plugins is like locking your front door but leaving the windows open. In this article, you'll learn 10 manual hardening steps that every WordPress admin should perform, regardless of which plugins they use. These steps require no coding expertise and can be done in under an hour. Let's start fortifying your site from the ground up.

1. Set Correct File Permissions

One of the most common misconfigurations is overly permissive file and directory permissions. Ideally, all files should be 644 and directories 755. The wp-config.php file is particularly sensitive—set it to 440 or 400 after installation. Use an FTP client or your host's file manager to adjust permissions. If you're unsure about your current settings, run a quick audit using a script or check via the command line with find /path -type f -exec chmod 644 {} \; and find /path -type d -exec chmod 755 {} \;. This simple change prevents unauthorized users from reading or modifying critical files.

2. Disable File Editing from the Dashboard

By default, WordPress allows administrators to edit theme and plugin files directly from the admin panel. If an attacker gains access to an admin account, they can inject malicious code. Disable this feature by adding the following line to your wp-config.php file:

define('DISALLOW_FILE_EDIT', true);

This doesn't affect your ability to upload themes or plugins—it only removes the inline file editor. Use an IDE or FTP for legitimate edits.

3. Disable Directory Browsing

If directory browsing is enabled, anyone can list all files in your wp-content/uploads folder, potentially exposing private data. Prevent this by adding this line to your .htaccess file (Apache) or equivalent configuration:

Options -Indexes

For Nginx, add autoindex off; in the server block. Test by visiting a directory URL; you should see a 403 Forbidden error instead of a file list.

4. Disable XML-RPC

XML-RPC is an old protocol used for remote publishing and trackbacks. It's a common vector for brute force attacks and DDoS amplification. Unless you absolutely need it (e.g., for the Jetpack plugin or mobile app), disable it entirely. Add this to your .htaccess:

# Block WordPress xmlrpc.php requests
<Files xmlrpc.php>
order deny,allow
deny from all
</Files>

Alternatively, use a plugin or your host's firewall to block access. After disabling, test that your site still works—most modern plugins no longer rely on XML-RPC.

5. Remove Unused Themes and Plugins

Every extra theme or plugin increases your attack surface. Even if deactivated, outdated code can still be exploited. Delete any themes you're not actively using, and remove plugins that are no longer needed. This is especially important for abandoned plugins that no longer receive updates. For a step‑by‑step cleanup guide, see our article on the hidden danger of abandoned WordPress plugins.

6. Change the Database Table Prefix

By default, WordPress uses wp_ as the table prefix in the database. This is widely known and makes SQL injection attacks easier. Change the prefix to something unique during installation. If your site is already live, you can still change it—though it requires more effort. Use a plugin like "Change Table Prefix" or do it manually via phpMyAdmin:

1. Export your database.
2. Rename all tables using a new prefix (e.g., mysec_).
3. Update wp-config.php with the new prefix.
4. Update the options and usermeta tables where the old prefix is used.

Always backup before attempting this.

7. Limit Login Attempts

Brute force attacks are the most common way attackers gain access. WordPress doesn't have built‑in login attempt limiting. Implement this manually by adding code to your theme's functions.php or, better, use a must‑use plugin. Alternatively, your hosting provider may offer this via the control panel. If you prefer a plugin, choose one that's lightweight and well‑coded. For a broader strategy on responding to breaches, check out our WordPress security remediation workflow.

8. Change the Admin Username

Never use "admin" as your username—it's the first guess in any brute force attack. If you already have an account with that username, create a new administrator account with a unique name, then delete the old one. Also, consider using an email address to log in instead of a username.

9. Strengthen Database Salts and Keys

WordPress uses salts and keys to encrypt user sessions and cookies. If these are compromised, attackers can forge sessions. Generate new, strong salts using the WordPress Salt Generator. Copy the output and replace the corresponding lines in your wp-config.php. Do this periodically, especially after a security incident.

10. Enable Automatic Updates for Core

Keeping WordPress core up to date is critical. Enable automatic updates for minor and major releases by adding this to wp-config.php:

define('WP_AUTO_UPDATE_CORE', true);

For major releases, you may want to test on a staging site first, but do not delay security updates. Combine this with regular manual checks for plugin and theme updates.

Conclusion

Manual hardening is the foundation of a secure WordPress site. These 10 steps address common vulnerabilities that scanners and plugins often overlook. By implementing them, you reduce your attack surface and gain peace of mind. Remember that security is a continuous process—periodically revisit these configurations. For a comprehensive approach, see our proactive WordPress security auditing guide. Start today with one step, and build from there. Your site's security depends on the actions you take now.