Securing a WordPress website with practical maintenance and access controls

Keep a recent backup of both files and the database, and know how to restore it. Store an appropriate copy outside the same hosting account where possible. Test major updates on staging, then apply supported WordPress, plugin and theme updates in a planned sequence. Remove unused code after checking dependencies and preserving its data.

Check that the selected PHP version is supported and compatible with your application. Obtain themes and plugins from their original developers or official directories. Unofficial repackaged commercial extensions can contain malicious changes and may have no reliable update route.

• Give each person a separate account with the least role needed for their work. A writer usually does not need Administrator access.
• Use unique strong passwords and suitable two-factor authentication. Protect the recovery mailbox and your client account as carefully as WordPress.
• Remove former staff access and review administrator accounts, active sessions and application passwords.
• Use HTTPS for the website and login. Review rate limiting or login protection available for the actual service without assuming a universal attempt threshold.

If nobody needs the dashboard's theme and plugin file editors, an authorised administrator can disable them by adding the following setting to the correct wp-config.php, before the stop-editing comment. Back up that file and avoid duplicate definitions.

define('DISALLOW_FILE_EDIT', true);

This disables the built-in file editors; it does not prevent all file writes or replace access controls. Do not confuse it with settings that also disable installations and updates. Avoid pasting old Apache access rules into a server using a different web-server configuration.

Verify that administrators can still sign in, scheduled tasks run, updates remain possible and important integrations work. Blocking XML-RPC or REST access indiscriminately can break legitimate services. A custom login URL can reduce some unwanted requests, but it is not a substitute for authentication security.

If you discover unknown administrators, altered files or unexpected redirects, record the symptoms and contact us. Preserve relevant logs and avoid repeatedly restoring an infected backup. A proper recovery checks the entry point, removes malicious changes, updates vulnerable components and rotates affected credentials. No single security setting can guarantee that a site will never be compromised.

• Updating WordPress safely from the administration dashboard
• Changing your WordPress account password
• Deactivating and deleting a WordPress plugin
• Cloning and synchronising WordPress websites

• Hardening WordPress
• WordPress configuration