Updating Plugins Is Not a Security Strategy
It's the bare minimum. Real security is layered.
Our Hardening Checklist
- Disable XML-RPC & REST API for unauthenticated users
- Block XML-RPC pingbacks at nginx level
- Limit login attempts: 3 failures = 15min lockout
- 2FA enforced for all admin users (TOTP)
- File integrity monitoring: Tripwire on wp-content
- Disable file editing in wp-admin (DISALLOW_FILE_EDIT)
- Move wp-config.php outside web root
- Security headers: CSP, HSTS, X-Frame-Options, Referrer-Policy
- WAF: Cloudflare Pro or ModSecurity rules
- Daily malware scans: ClamAV + WP-CLI integrity checks
Real Incident
Client on shared hosting: compromised plugin injected spam links. Shared host cleanup missed database backdoors. We migrated to hardened VPS, cleaned DB, hardened config. Zero recurrence in 18 months.
Sleep better. Harden your site.
