Get Support Sign in →
LochStudios  /  Help Centre  /  WordPress  /  Secure Your WordPress Site

Secure Your WordPress Site

Harden WordPress on our shared hosting with Toolkit security, AutoSSL, strong logins, tight files and MariaDB, and the hourly copies we already keep.

Updated

WordPress is common, so bots try the usual doors: the admin user, a reused password, an old plugin, and http://. On Beginner and Standard shared hosting (cPanel) in Australia you already have the tools to close those doors. This article is that checklist.

Open cPanel from the portal. Do not guess a hostname.

On a VPS you manage the files, MariaDB, the firewall, and TLS yourself. Credentials and the console are on that server in the portal. See the VPS section below.

On a dedicated server, open a support ticket and we will walk you through access.

Install WordPress with WordPress Toolkit or Installatron, not a zip from wordpress.org. Those tools create the MariaDB database, write wp-config.php, and give you the security and update controls below. See Install WordPress.

A step is unclear, or you would rather we apply the hardening? Open a support ticket and we will help.

Open cPanel

  1. Sign in at the portal.
  2. Open the hosting service for the site.
  3. Click Log in to cPanel.

You do not need a server hostname to get in.

Use the File Manager for file steps. Turn on Show Hidden Files (dotfiles) under Settings so you can see wp-config.php and .htaccess. For a large wp-content folder, use FTP.

The document root is public_html for the main domain, or the addon / subdomain folder for that name.

Start in WordPress Toolkit

If Toolkit already lists this install, use it first. Do not start by installing a security plugin or by downloading WordPress again.

  1. In cPanel, open WordPress Toolkit.
  2. Find the site.
  3. Open Security (the card may show a count such as measures applied).
  4. Apply the recommended measures. Typical items are: disable the Theme and Plugin file editor, block directory listing, block access to wp-config.php and other sensitive files, turn off PHP in wp-includes and wp-content/uploads, and refresh the security keys in wp-config.php.
  5. Open Updates on the same card. Turn on automatic updates for WordPress (at least minor and security releases). Turn them on for plugins and themes if you are happy for those to update without a click.

If a measure would break a plugin you actually use (XML-RPC for Jetpack or the official mobile app is the usual case), leave that one off and apply the rest.

Installatron: open My Applications, choose the WordPress install, and use its update and backup controls if they are there. If the site is not listed in either tool, use the WordPress admin and File Manager steps below. You do not have to reinstall to harden it.

Change the default admin username

Bots try admin first. A Toolkit or Installatron install should already have asked for a unique username. If this site still has a user called admin or administrator, replace it.

  1. Log in to WordPress (/wp-admin) and go to Users → Add New.
  2. Create a new user with a unique username (not admin, not your domain, not your email local-part). Role Administrator. Set a long unique password (next section).
  3. Log out, then log in as the new user.
  4. Go to Users, delete the old admin user, and reassign its posts to the new account.

Do not rename the user by editing the database unless you know the table prefix and the side effects. Creating a new administrator and deleting the old one is the safe path.

Day to day, work as an Editor or Author and keep the administrator login for updates and settings. See Keep your website secure.

Use a strong, unique password

The WordPress administrator password is not your portal password, and it is not the MariaDB user password in wp-config.php. Each of those three should be different.

  • At least 16 characters, mixed case, numbers, and symbols.
  • Never reuse it on another site or mailbox.
  • Store it in a password manager, not a note on the desktop.

How to pick and store one: Create strong passwords and use a password manager.

Change a password when you think it leaked, when a contractor finishes, or when you delete a user. A calendar rotation every 90 days is optional if the password is long and unique.

A two-factor plugin on WordPress is worth turning on if you keep an administrator account on a public URL.

Turn on HTTPS

Shared hosting includes AutoSSL (Let's Encrypt). The name must already resolve to this account.

  1. In cPanel, open SSL/TLS Status.
  2. Find the domain and www.
  3. Run AutoSSL if a certificate is not there yet, then wait for a valid cert on that row.
  4. In cPanel Domains, turn Force HTTPS Redirect on for that name. You do not need a 301 in Redirects for same-host HTTP to HTTPS. See Set Up a Domain Redirect.
  5. In WordPress go to Settings → General. Set WordPress Address and Site Address to https://. Save.

The padlock appears after the certificate is issued and you reload over HTTPS. Background: Understanding SSL/TLS and HTTPS.

If SSL/TLS Status still shows no certificate after DNS has updated, open a support ticket.

A lock icon with mixed-content warnings (images or scripts still loaded over http://) is a different job: Fix "Not secure" and mixed-content warnings.

Do not paste a RewriteRule into .htaccess as the first HTTPS step. Force HTTPS Redirect is the control on this hosting. If you already have a custom .htaccess and the site loops or 500s after an edit, rename the file and see Fix the WordPress White Screen of Death / HTTP 500.

Keep WordPress, themes, and plugins updated

Old plugins are the usual way sites get compromised. Prefer Toolkit Updates (above). In WordPress itself:

  1. Go to Dashboard → Updates.
  2. Update WordPress, then plugins, then themes.
  3. Load the site and a wp-admin page after each batch.

If an update blanks the site, deactivate that plugin or switch theme from Toolkit, or follow Fix the WordPress White Screen of Death / HTTP 500. We keep hourly copies of the account. To put the folder back from before the update, open a support ticket and tell us the domain and the time.

Keep PHP on a current version this server offers. See Choose your PHP version.

Remove unused themes and plugins

Every installed theme and plugin is code the site can run, even when it is not the active one.

  1. In Toolkit, open Plugins and Themes, or in WordPress go to Plugins and Appearance → Themes.
  2. Deactivate anything you do not use, then Delete it. Deactivate is not enough.
  3. Keep one default WordPress theme (Twenty Twenty-Four, Twenty Twenty-Five, or whichever default is listed) so you have a known-good fallback.

Do not leave abandoned plugins that have not been updated in years. Replace them, or remove the feature.

Limit login guesses

Bots try wp-login.php and xmlrpc.php with common passwords.

  • Apply Toolkit security measures that disable or limit XML-RPC if you do not need it.
  • If you want a lockout after failed wp-admin logins, install one security plugin (Wordfence or a similar login-lock plugin) and set it to lock after 5 to 10 failures in a short window. One plugin is enough. Two security plugins that both scan files will fight each other and slow the site.
  • Do not leave plugin backup zips or unused installers in public_html.

If the login page is being hammered and you cannot get in, open a support ticket. We can help you regain access and tighten the door.

Keep the database on this account

WordPress stores posts, users, and settings in MariaDB on this hosting. cPanel still labels the tools MySQL. Every Beginner and Standard plan includes unlimited MariaDB databases. The site on this account must use host localhost.

  • Use the full prefixed database name and username (username_shop, not shop).
  • Use a strong unique password on that database user. Changing it on MySQL Databases does not update wp-config.php. Change both in the same session. See Fix "Error Establishing a Database Connection" in WordPress.
  • Attach the user to only the database that WordPress needs.
  • Leave Remote MySQL empty unless something outside this account must connect. The public site does not need remote access. See Allow Remote MySQL Access.

Browse tables in phpMyAdmin when you need to. Need a new database for a copy or another app? Create a MySQL database and user.

Do not put the website domain in DB_HOST. That sends the connection away from this account.

Set file and folder permissions

Correct permissions stop a visitor from writing PHP into the site.

1. Open the File Manager on the document root.
2. Select a folder or file, then Permissions (or right-click → Change Permissions).
3. Use:
- Folders: 755
- Files: 644
4. You can set wp-config.php to 600 if you want it tighter. Reload the site. If WordPress cannot read the file, set it back to 644.

Never use 777. If a plugin cannot write after 755 / 644, open a support ticket rather than opening the permissions further.

Disable the built-in file editor

wp-admin includes Appearance → Theme File Editor and Plugins → Plugin File Editor. If an administrator account is guessed, those screens edit PHP in the browser.

Toolkit security (above) turns this off for you. To do it by hand:

  1. Open wp-config.php in the File Manager. It sits in the document root, next to wp-load.php, not inside wp-content.
  2. Add this line above /* That's all, stop editing! */:
define( 'DISALLOW_FILE_EDIT', true );
  1. Save. Confirm the Theme File Editor is gone.

A typo in wp-config.php takes the whole site down. If that happens, undo the line or open a support ticket and we can put the file back from the hourly copy.

Copies we already keep

Every Beginner and Standard plan includes Acronis hourly backups. Those copies live on a separate server and do not use your disk quota. You do not turn them on. Restore points sit in a 30-day window.

To put the account, the WordPress folder, or the database back from one of those points, open a support ticket. Tell us the domain, what to restore, and the date and time you want.

Hourly copies are not a file you download yourself. Before a redesign or a plugin experiment:

  • Take a Toolkit or Installatron backup and download it, or
  • Use Backup / Backup Wizard in cPanel, or
  • Copy files and export the database yourself.

Full steps: Back Up and Migrate a WordPress Site and Download and Restore a Backup.

Do not leave backup archives in public_html. They count toward disk and can be fetched if the site is compromised.

Watch for a compromise

Once a month, while you are in wp-admin:

  • Users: no extra administrators you did not create.
  • Pages and posts: no spam links or odd drafts.
  • Plugins: nothing installed that you did not add.

In cPanel, glance at Errors under Metrics and at resource usage if the site suddenly feels heavy.

If the site has already been changed by someone else, stop editing plugins and follow What to do if your website is hacked. Open a support ticket and tell us the domain. We can restore from an hourly copy and help you close the door.

WordPress on a VPS

On a VPS you are the administrator. Credentials and the console are on that server in the portal.

The WordPress steps (unique admin user, updates, DISALLOW_FILE_EDIT, no unused plugins) still apply. There is no WordPress Toolkit on a stock VPS unless you installed a panel yourself.

Open a support ticket if you want us to walk through the server with you.

If something is not working

Cannot reach wp-admin after hardening
A Toolkit measure or a security plugin may be blocking you. Use a private window. If you are still out, open a support ticket.

Site is HTTP 500 or a white screen after editing wp-config.php or .htaccess
Undo the last edit in File Manager, or ask us to restore that file. See Fix the WordPress White Screen of Death / HTTP 500.

Database error after you changed a password
The new password must also be in wp-config.php. See Fix "Error Establishing a Database Connection" in WordPress.

Browser says Not secure
AutoSSL has no cert yet, or WordPress still has http:// addresses. Recheck SSL/TLS Status and Settings → General, then Fix "Not secure" and mixed-content warnings.

Need hosting first? Browse shared hosting, VPS, or dedicated. After the account is ready: Getting started after you order hosting.

Do not wait on an email thread. Open a support ticket and we will help.

Related

Was this article helpful?

← Back to WordPress