WordPress Security Hardening Guide 2025: Protect Your Site from Threats

Server-level Nginx rules, fail2ban configuration, WAF setup, SSL hardening, and managed WordPress security best practices for UK hosting.

WordPress powers over 43% of all websites, making it the most targeted CMS by attackers. In 2024 alone, over 90 million WordPress attacks were blocked per month by security providers. For UK businesses, a compromised WordPress site means not just downtime but potential UK GDPR fines, customer data exposure, and reputational damage.

This guide covers every layer of WordPress security — from server-level hardening to application-level protections — so you can run a WordPress site that's genuinely secure, not just "good enough."

Layer 1: Server-Level Security

Your WordPress site is only as secure as the server it runs on. Here's how we harden hosting environments at Hostingowy:

1.1 SSH Hardening

Disable password authentication and use SSH keys only. Change the default SSH port and install fail2ban to rate-limit login attempts:

# /etc/ssh/sshd_config
PasswordAuthentication no
PubkeyAuthentication yes
Port 2222
PermitRootLogin prohibit-password

# Then restart SSH and configure fail2ban
sudo systemctl restart sshd
sudo fail2ban-client set sshd maxretry 3
sudo fail2ban-client set sshd bantime 3600

1.2 Nginx Hardening

Default Nginx installations are surprisingly insecure. Here are the minimum hardening rules every WordPress host should apply:

# Disable server tokens (hides Nginx version)
server_tokens off;

# Limit request size to prevent buffer overflow attacks
client_max_body_size 10M;

# Add security headers
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

# Rate limit wp-login.php
location = /wp-login.php {
    limit_req zone=wplogin burst=5 nodelay;
    # ... standard PHP fastcgi config
}

# Block access to sensitive files
location ~* /(wp-config\.php|wp-admin/includes|wp-includes/.*\.php) {
    deny all;
    return 403;
}

# Block XML-RPC unless explicitly needed (prevents brute-force attacks)
location = /xmlrpc.php {
    deny all;
    return 403;
}

1.3 Fail2Ban for WordPress

Fail2Ban monitors log files and bans IPs showing malicious behaviour. Here's a custom WordPress fail2ban filter:

# /etc/fail2ban/jail.d/wordpress.conf
[wordpress]
enabled  = true
port     = http,https
filter   = wordpress
logpath  = /var/log/nginx/access.log
maxretry = 5
bantime  = 86400
findtime = 600

# /etc/fail2ban/filter.d/wordpress.conf
[Definition]
failregex = ^<HOST> .* "POST .*wp-login\.php
            ^<HOST> .* "POST .*xmlrpc\.php
            ^<HOST> .* .* 404 .*wp-content/plugins/.*
ignoreregex =

Layer 2: WordPress Application Security

2.1 Update Everything, Always

Over 60% of WordPress hacks come from outdated core, plugins, or themes. Enable automatic updates for core and audit plugins regularly:

• WordPress core: Enable auto-updates in wp-config.php: define('WP_AUTO_UPDATE_CORE', true);
• Plugins: Remove unused plugins immediately. Only install plugins from the WordPress.org repository or reputable developers.
• Themes: Stick to well-maintained themes. Nulled or pirated themes are the #1 source of WordPress malware.

2.2 Hardened wp-config.php

// Disable file editing from the admin panel
define('DISALLOW_FILE_EDIT', true);

// Disable plugin and theme installation from admin
define('DISALLOW_FILE_MODS', true);

// Set secure salts and keys (use https://api.wordpress.org/secret-key/1.1/salt/)
define('AUTH_KEY',         'your-random-key-here');
define('SECURE_AUTH_KEY',  'your-random-key-here');
define('LOGGED_IN_KEY',    'your-random-key-here');
define('NONCE_KEY',        'your-random-key-here');
define('AUTH_SALT',        'your-random-key-here');
define('SECURE_AUTH_SALT', 'your-random-key-here');
define('LOGGED_IN_SALT',   'your-random-key-here');
define('NONCE_SALT',       'your-random-key-here');

// Force SSL for admin and login
define('FORCE_SSL_ADMIN', true);

// Limit post revisions to prevent database bloat
define('WP_POST_REVISIONS', 10);

// Set automatic garbage collection for transients
define('WP_AUTO_UPDATE_CORE', true);

2.3 User Management Best Practices

• Never use "admin" as a username — it's the first credential attackers try
• Strong password policy: Enforce 16+ character passwords with special characters
• Two-Factor Authentication (2FA): Use WP 2FA or Google Authenticator plugins
• Limit login attempts: Use Login LockDown or Limit Login Attempts Reloaded
• Role management: Give users the minimum capabilities they need — no Administrator accounts for content editors

Layer 3: Web Application Firewall (WAF)

A WAF filters out malicious traffic before it reaches WordPress. There are two approaches:

Type	Pros	Cons	Recommendation
Cloud WAF (Cloudflare, Sucuri)	DDoS protection, CDN, no server load	DNS change required, monthly cost	Best for most sites
Server-level WAF (ModSecurity)	No external dependency, full control	Performance overhead, complex config	Good for high-traffic sites
Plugin WAF (Wordfence, Sucuri)	Easy setup, WordPress integration	Consumes PHP resources, limited at network level	Good starting point

Layer 4: SSL/TLS Configuration

HTTPS is non-negotiable in 2025. But not all SSL configurations are equal. Here's how to configure TLS properly:

# /etc/nginx/conf.d/ssl.conf
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
ssl_session_tickets off;
ssl_stapling on;
ssl_stapling_verify on;

# HSTS (uncomment after confirming HTTPS works)
# add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;

Layer 5: Backup & Recovery Plan

Even the most secure WordPress site can be compromised. A proper backup strategy limits damage to hours instead of weeks:

The 3-2-1 Backup Rule Applied to WordPress

• 3 copies of your data (production + 2 backups)
• 2 different media types (e.g., local NVMe + off-site object storage)
• 1 off-site copy (geographically separate location)

At Hostingowy, every managed WordPress plan includes:

• Daily automated backups with 7-day retention
• ZFS snapshots every 6 hours for rapid rollback
• Off-site backups stored in a geographically separate European data centre
• One-click restore from the hosting control panel
• Encrypted backups (AES-256) both in transit and at rest

WordPress Security Checklist for UK Businesses

• SSH key-only authentication, password auth disabled
• Nginx server_tokens disabled; security headers configured
• Fail2Ban installed with WordPress-specific rules
• WordPress core, plugins, and themes up to date
• File editing disabled in wp-config.php
• SSL/TLS configured with TLS 1.2+ only, HSTS enabled
• Login attempt limiting and 2FA enforced
• WAF active (cloud or server-level)
• Daily automated backups with off-site storage
• Regular security audits using WPScan or similar
• Monitoring and alerting for suspicious activity
• Incident response plan documented and tested

How Hostingowy Keeps WordPress Sites Secure

Every managed WordPress hosting plan at Hostingowy includes server-level security as standard:

• Isolated containers — Your WordPress site runs in an isolated environment, not a shared pool. No noisy neighbours, no cross-site contamination.
• Nginx + PHP 8.2 FPM — Modern, secure web serving with OPcache for performance and security.
• Redis caching — Full-page caching reduces PHP execution and limits attack surface.
• Free SSL certificates — Auto-renewing Let's Encrypt certificates for every site.
• European data centres (Poland) — Your data stays in Europe under GDPR jurisdiction, with GDPR-compliant data processing agreements.
• 24/7 monitoring — Proactive infrastructure monitoring with automated threat response.

Related reading: WordPress Performance Tuning: From 2s to 200ms • UK GDPR Hosting Compliance Guide • Ultimate Guide to UK VPS Hosting