Most sites get hacked not because they were specifically targeted, but because they were easy. Default setups leave several settings in place that make the job simpler for automated bots and brute-force tools scanning millions of sites every day. The good news is that tightening those weak points takes less than an hour.
Security hardening is the process of adjusting your website’s setup to reduce the surface area for attack. Whether you’ve just set up your site or are working through the step-by-step guide to making a website, running through this checklist before going live is one of the most important things you can do. A hardened site doesn’t become impenetrable — no site is — but it gets passed over in favour of softer targets, and that’s the practical goal.
I run through these steps on every site I build before handing it to a client. They cover the settings that matter most and that beginners most commonly miss.
Quick Answer
To harden your website’s security after launch: update your platform, themes, and plugins or extensions; change any default admin username; use a strong, unique password; limit login attempts; enable two-factor authentication; set correct file permissions; install a firewall; and protect your site’s configuration file. On WordPress specifically, this also means disabling XML-RPC. Each step closes a known attack path.
Why This Matters
A fresh installation is functional but not particularly hardened. The default configuration is built for broad compatibility, not maximum security. Bots scan for sites running outdated software, weak login credentials, and exposed configuration files continuously — and they find them.
Common attack paths on unhardened sites include brute-force login attacks, exploitation of vulnerabilities in outdated plugins or extensions, and direct access to sensitive configuration files. These steps close those gaps methodically.
How to Harden Your Website’s Security After Launch
Keep Everything Updated
The single most effective security measure is keeping your platform, themes, and plugins updated. The majority of successful website hacks exploit known vulnerabilities in outdated software — vulnerabilities for which patches already exist.
Enable automatic updates for minor releases if your platform supports it. For plugins or extensions and themes, review and apply updates at least weekly. Remove anything you’re not actively using — inactive plugins still represent risk if they contain vulnerabilities.
On WordPress, automatic minor-core updates can be turned on under Dashboard → Updates.
Use a Strong Admin Username and Password
If you used a default or predictable username like “admin” during setup, change it immediately. Create a new administrator account with a distinct username, log in with the new account, then delete the original and reassign its content to the new one.
On WordPress, this means going to Users → Add New to create the replacement account.
Use a password manager to generate a random password of at least 20 characters. Weak or reused passwords remain the most common entry point on hacked sites.
Limit Login Attempts
Most platforms allow unlimited login attempts by default, making automated password guessing straightforward. A login-limiting plugin or built-in setting changes this — after a set number of failed attempts from an IP address, further attempts are blocked for a defined period.
On WordPress, Limit Login Attempts Reloaded handles this with minimal configuration beyond installation. Set the threshold to three or five failed attempts before triggering a lockout.
Enable Two-Factor Authentication
Two-factor authentication adds a second layer to your login — even if someone has your password, they can’t get in without the second factor. On WordPress, use a plugin such as WP 2FA, Wordfence Login Security, or the official Two Factor plugin to set up authenticator app-based 2FA for all administrator accounts.
This is one of the most effective single changes you can make. Even a compromised password becomes useless to an attacker without access to your phone or authenticator app.
Set Correct File Permissions
File and directory permissions control which processes can read or write to your files on the server. Incorrect permissions — particularly files set to world-writable — can allow unauthorised modification of your site’s content and code.
The correct settings are:
- Directories: 755
- Files: 644
- Core configuration file (wp-config.php on WordPress): 600 or 640
You can check and adjust these via cPanel’s File Manager or via FTP. Most managed hosts set these correctly by default; shared hosting environments sometimes do not.
Disable XML-RPC (WordPress Only)
On WordPress specifically, disable XML-RPC — a remote access protocol built into WordPress that has been exploited for amplified brute-force attacks. Most sites don’t need it — it’s only required if you use a mobile app or remote publishing tool to post to your site.
The simplest method is a dedicated plugin, or a filter in your theme’s functions.php file. Most security firewall plugins also include this as a toggle, so check your security plugin settings before installing a second plugin for this purpose. This isn’t relevant if you’re on a different platform — XML-RPC is a WordPress-specific legacy feature.
Install a Firewall
A website firewall filters malicious requests before they reach your site. On WordPress, plugins like Wordfence or Solid Security provide a web application firewall, malware scanning, and login security in one package.
After installation, run the setup wizard and enable the firewall in learning mode for a day or two before switching to enforcement mode. This avoids accidentally blocking legitimate traffic from your own admin activity.
Protect Your Configuration File
Your site’s core configuration file — wp-config.php on WordPress — contains your database credentials and security keys. If you’re on WordPress, add the following rule to your .htaccess file to block direct web access to it:
<files wp-config.php>
order allow,deny
deny from all
</files>This prevents access to the file even if directory permissions are misconfigured.
Change the Default Login URL
Most platforms use a predictable default login path. Automated tools know this and continuously hammer these addresses with login attempts. Moving your login page to a custom URL, where your platform supports it, significantly reduces bot traffic hitting your login form.
On WordPress, the default login lives at /wp-login.php and /wp-admin/; a plugin like WPS Hide Login moves it to a custom URL of your choice.
Practical Tips
Run through this checklist before a site goes live, not after. Retrofitting security on an active site with existing content and users is more disruptive and easier to miss steps on.
Document the changes you make — particularly the custom login URL and any other under-the-hood security changes — somewhere secure. You’ll need them for future maintenance and troubleshooting.
In most sites I build, a combination of login hardening, a good firewall, and keeping everything updated handles the vast majority of real-world threats. On WordPress, the WordPress hardening documentation covers additional server-level steps worth reading if you have hosting control panel access.
Common Mistakes
Skipping updates because they feel risky. Updates do occasionally break things — which is exactly why you take a backup before applying them. Avoiding updates entirely is far more dangerous long-term.
Installing a security plugin and assuming the job is done. A firewall reduces risk; it doesn’t eliminate it. The manually managed steps — strong passwords, correct file permissions, removing unused plugins — still matter and no plugin handles them for you.
Leaving unused themes or templates installed. Default or bundled themes accumulate vulnerabilities over time just like any other theme. Delete any you’re not actively using.
Hardening vs Ongoing Security Monitoring
Security hardening is preventive — it reduces the number of ways an attacker can get in. It’s distinct from ongoing monitoring, which involves watching for signs that a breach has already occurred.
For most small sites, hardening plus a security tool that includes malware scanning covers both adequately. Larger sites or those handling sensitive data benefit from dedicated monitoring services or a managed host with built-in security scanning. Hardening is always the right starting point, regardless of site size.
One specific step worth calling out on its own: if you haven’t already, make sure the site has a valid SSL certificate set up. It’s easy to assume this was handled at launch and never check again, but certificates can lapse or end up only partially enforced across the site.
Hardening a site at launch covers the obvious entry points, but security posture drifts over time as plugins are added, users come and go, and updates get skipped. Running a periodic security audit every few months catches what the initial setup can’t anticipate — including whether your backups are actually working.
Conclusion
Work through these steps right after setting up your site and before you start building. Updating everything, changing the default admin username, setting a strong password, limiting login attempts, and installing a firewall takes under an hour — and that hour makes your site significantly harder to compromise than most sites left on default settings.
Etienne Basson works with website systems, SEO-driven site architecture, and technical implementation. He writes practical guides on building, structuring, and optimizing websites for long-term growth.