The Loop Log

A Practical Introduction to Securing Your WordPress Site

WordPress powers more than 40% of the web, which makes it an incredible platform. It is flexible, customizable, and supported by a massive ecosystem of themes and plugins. But that popularity comes with a downside: attackers love WordPress too.

Not because WordPress is inherently insecure, but because:

• many site owners never change default settings
• hosting environments vary wildly
• plugins introduce unpredictable code
• common attack surfaces are left wide open

Hardening your WordPress site isn’t about paranoia. It’s about removing the easy wins attackers rely on.

This series walks through a real-world hardening process, based on steps I used to secure one of my own sites, and breaks it down into clear, actionable improvements anyone can follow.

Why Hardening Matters

Most WordPress compromises don’t happen because of “elite hackers.”
They happen because of:

• writable directories that execute code
• XML-RPC endpoints left open
• usernames exposed publicly
• file editors available to anyone who gains access
• outdated or conflicting rewrite rules
• plugins that leak information through the REST API

Attackers don’t need to break in if the door is already open. Hardening is the process of closing those doors, one by one, without breaking your site or making it harder to manage.

The Myth of the “Secure Plugin”

Many people assume that installing a security plugin like Wordfence or Sucuri is enough. Security plugins are powerful, but they are reactive:

• They block malicious requests
• They scan for malware
• They alert you to suspicious activity

But they cannot fix server-level weaknesses like:

• PHP execution in uploads
• XML-RPC exposure
• author enumeration
• file editing in the dashboard
• misconfigured .htaccess rules

Hardening fills the gaps that plugins can’t reach.

The Real Attack Vectors Most People Ignore

Here are the areas attackers target most often, and the ones this series will walk you through:

1. The Uploads Directory
   This is the most common place for malware to hide
   If PHP can run in /wp-content/uploads/, an attacker can upload a backdoor and execute it.
2. XML-RPC
   A legacy feature that enables:

• brute-force amplification
• pingback attacks
• remote code execution in older exploits

Most sites don’t need it at all.

3. Author Enumeration
   Attackers love discovering valid usernames.
   Once they know a username, brute-forcing the password becomes trivial.
4. File Editing in the Dashboard
   If an attacker ever gets into your admin panel, the built-in theme/plugin editors give them instant access to your PHP files.
5. REST API Exposure
   The REST API is powerful, but it can leak user data, metadata, and plugin information unless configured properly.
6. Rewrite Rules
   A messy .htaccess file can:

• break security headers
• expose sensitive directories
• allow unintended file execution
• conflict with plugins

Cleaning this up is one of the most overlooked steps in WordPress security.

What This Series Covers

This series is built around a real hardening process; not theory, not guesswork. Each part focuses on a specific area and walks through:

• what the risk is
• how to test your site
• how to fix it
• how to verify the fix
• what to avoid

Here’s the roadmap:

Part 1 – Why WordPress Hardening Matters (You’re reading it now).

Part 2 – Securing the Uploads Directory. How to block PHP execution, disable indexing, and test script behavior.

Part 3 – Cleaning and Understanding Your Rewrite Rules. A practical guide to .htaccess and avoiding conflicts.

Part 4 – Shutting Down XML‑RPC and Author Enumeration. Two major attack surfaces most people don’t realize are open.

Part 5 – Advanced Hardening. Locking down the dashboard, tightening the REST API, and final polish.

Who This Series Is For

This guide is perfect for:

• WordPress site owners
• bloggers
• small business owners
• developers who want a clean baseline
• anyone who wants to secure their site without breaking it

You don’t need to be a sysadmin or a security expert. You just need to be willing to follow the steps.

What You’ll Gain

By the end of this series, you’ll have:

• a hardened WordPress installation
• a clean and safe .htaccess
• blocked attack vectors
• reduced exposure of sensitive data
• a site that’s significantly harder to compromise

And you’ll understand why each step matters, not just how to do it.

Coming Up Next: Part 2 – Securing the Uploads Directory

This is the single most important hardening step, and it’s where we’ll begin.