The Complete WordPress Hardening Guide: Essential Steps to Secure Your Website

Hardening means changing the default settings that make WordPress easier to attack: locking down configuration files, adding browser security headers, tightening the database user and switching off features you do not use. This checklist covers those hardening steps in order, with code that is correct for 2026. The everyday security habits, such as updates, passwords and two-factor authentication, have their own guides, linked below.

1. The hardening checklist at a glance

Before you edit any file, download a copy of it. A typing mistake in .htaccess gives a 500 error until you undo it; see troubleshooting 500 internal server errors.

2. Harden wp-config.php

wp-config.php holds your database password and security keys, so it gets the most protection.

Turn off the dashboard code editor. Add this line above "That's all, stop editing":

define( 'DISALLOW_FILE_EDIT', true );

Anyone who steals an administrator login can then no longer paste malicious code into a theme or plugin from the dashboard. You can still edit files through the File Manager, SFTP or Git.

Block web access to the file. Add this to the .htaccess file in your WordPress folder:

<Files wp-config.php>
    Require all denied
</Files>

Older guides show order allow,deny and deny from all. That is Apache 2.2 syntax; use Require all denied.

Tighten its permissions to 640, or 600 if the site still loads. Folders stay at 755 and files at 644; never use 777. You can change permissions in the File Manager.

Refresh the security keys after any incident. Replace the eight AUTH_KEY to NONCE_SALT lines with a new set from the official WordPress secret-key generator. Everyone, including any attacker, is logged out.

Moving wp-config.php one folder above the WordPress folder also works, because WordPress looks there automatically. It adds little once the file is blocked as above, so it is optional.

3. Lock down folders with .htaccess

.htaccess files work on Domain India cPanel, DirectAdmin and Webuzo hosting, and mod_rewrite is available on all three.

Switch off directory listing. On our cPanel servers, directory listing is on by default, so a folder without an index file shows every file in it. Add this line to .htaccess:

Options -Indexes

The folder then shows a 403 Forbidden error instead of a file list.

Stop PHP running in the uploads folder. Images never need to run as code, but a malicious upload does. The rule and the test for it are in common WordPress security issues, section 7.

You do not need a rule to hide .htaccess itself. Apache refuses requests for .ht files by default.

4. Force HTTPS and add security headers

Free SSL is included with Domain India hosting. On cPanel, certificates are issued and renewed automatically, and the Domains page has a Force HTTPS Redirect switch for each domain. Then set both addresses in WordPress Settings › General to https://.

Security headers tell the browser how to treat your pages. The mod_headers module is loaded on our cPanel and DirectAdmin servers, so you can add them in .htaccess:

<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
</IfModule>

• X-Frame-Options stops other sites showing yours in a frame (clickjacking).
• X-Content-Type-Options stops the browser guessing file types.
• Leave out X-XSS-Protection. Older guides recommend it, but modern browsers removed the feature it controlled.

Add these two with care:

• Strict-Transport-Security (HSTS) tells browsers to use HTTPS only. Add it only when every subdomain works over HTTPS, start with a short max-age, and do not add preload unless you understand that it is hard to undo.
• Content-Security-Policy (CSP) limits where scripts may load from. WordPress themes and plugins use many inline and third-party scripts, so a strict policy breaks sites easily. Start with Content-Security-Policy-Report-Only, watch the browser console, and tighten it gradually.

Check the result in your browser's developer tools under Network, then the response headers. On cPanel hosting, pages can be cached for up to two hours, so add ?t=1 to the address when you test a change.

5. Tighten the database

• One database user per site. Give each WordPress site its own database and its own user, with privileges on that database only. A leaked password for one site then cannot reach another.
• Do not cut the user down to SELECT, INSERT, UPDATE and DELETE. Older guides suggest it, but WordPress and plugin updates need to create and alter tables, so updates fail. Limit the user's reach to one database, not the privileges inside it.
• Table prefix: choose something other than wp_ when you install a new site. Changing it on a live site gains little and can break it.
• Remote database access: port 3306 is closed from outside on our shared servers. If you need to reach the database from your computer, use an SSH tunnel.

6. Firewall, monitoring and backups

Web application firewall (WAF). On our cPanel servers, Imunify360 runs a web application firewall with its full ruleset and WordPress protection on by default, so many injection and brute-force attempts are blocked before they reach WordPress. A security plugin's firewall or a service such as Cloudflare adds another layer; see the Cloudflare setup guide.

XML-RPC. If you do not use Jetpack or an app that publishes through xmlrpc.php, block it. The rule is in the main guide, section 3.

Monitoring. Install one security plugin, such as Wordfence, Solid Security (formerly iThemes Security) or Sucuri Security, with email alerts for new administrators, changed files and vulnerable plugins. Two security plugins together often conflict.

Backups. Domain India cPanel and DirectAdmin hosting runs weekly JetBackup 5 backups and keeps five copies, which you can restore or download from the panel; see backup and restore with JetBackup. Keep your own copies off the server as well, because malware can sit unnoticed for longer than a week.

7. Where Domain India hosting fits

The server side is handled for you. On our cPanel servers, CloudLinux CageFS keeps each account's files isolated, Imunify360 cleans malicious code from infected files automatically and keeps the original for 14 days, and WP Toolkit is available to manage WordPress installations. The same protection applies to every plan, so choose by resources.

Plan cards show live Domain India list prices, excluding 18% GST. Hosting cannot update your plugins or stop someone who logs in with your real password, so the steps above are still yours. If your site has already been hacked, follow the security checklist for hacked websites.

Ready to harden your site? Start with updates and 2FA from common WordPress security issues, work through the checklist above, and open a support ticket if something on your hosting account looks wrong.