Have a web emergency? We'll fix your site free! →
WP Farm's logo.
Main Menu
Menu
Main Menu
Site Health · Optimization

WordPress Security Hardening Built Into Your Server

Most hacks start with a weak setting or an old plugin. We lock down logins, files and the server so attacks stop before they reach your site.

  • Imunify360 and WAF rules
  • Login and XML-RPC lockdown
  • File permission hardening
  • Forced core updates
Harden My Site
Run a Free Security Test
  • Trusted WP Experts Since 2008
  • Trustpilot Excellent ★ 4.3
  • Secure or It’s Free Guarantee
Isometric rack server inside a rotating glass shield cylinder with a neon shield outline above it and a lock on its own stand

The doors attackers try first

Most attacks are automated. Bots look for the same weak spots on every WordPress site. Switch views to see what hardening closes.

6 weak spots, open to bots0 weak spots, locked down

Login pageOpen to unlimited password guesses.Brute force blocked at the edge and on the server./wp-login.php
OpenLocked
XML-RPCLets bots try many passwords in one request.Turned off, or limited to the apps you use./xmlrpc.php
OpenLocked
File permissionsWritable files let an attacker change your code.Ownership and permissions reset, uploads can’t run PHP.wp-content/uploads/
WritableFixed
Outdated softwareKnown holes in core and plugins stay open.Core updates forced, vulnerable plugins patched.
OutdatedPatched
Web firewallMalicious requests reach WordPress.Imunify360 and Cloudflare WAF rules stop them first.
MissingOn
Admin accountsOld users and shared passwords still work.Accounts audited, passwords and salts rotated.
ExposedRotated

Illustration of common weak spots, not a customer report.Run a free security test

Everything in a hardening job

We lock down your site at three layers, the edge, the server and WordPress, then test and report on what changed.

Already hacked?Start with hack cleanup so the attacker is removed first. Hardening comes after every cleanup.

Edge and server

  • Imunify360 scan and rules
  • Cloudflare WAF and Bot Fight Mode
  • File permission and ownership reset
  • PHP blocked in the uploads folder

Logins and users

  • Login brute force lockdown
  • XML-RPC turned off or limited
  • Admin user and credential audit
  • Salts and passwords rotated

Software

  • Forced core updates
  • Plugin vulnerability check
  • Outdated plugins patched or replaced
  • PHP version check

Proof

  • Free security test before and after
  • Hardening report
  • Logins, forms and checkout tested
  • 1 month of free WP Farm hosting

Hardening at every layer

A security plugin can only act once a request reaches WordPress. We stop attacks at Cloudflare’s edge and the server first, then lock down WordPress.

What gets done
Security pluginWorks inside WordPress
Freelancer or agencyVaries by person
WP FarmOne team, server to site
Login lockdown
Yes
Yes
Yes
Firewall before WordPress loads
No
If you share access
Yes
File permissions and ownership
Checks only
If your host allows it
Yes
Server malware scanning
Inside WordPress only
If your host allows it
Yes
Forced core updates
Auto-updates only
Sometimes
Yes
Tested, with a hardening report
No
Sometimes
Yes
Kept current as threats change
Automatic rules only
No
With WP Farm hosting

Four steps to a locked-down site

You share access once. We harden, test and hand back a site that’s harder to break into.

  1. 1

    Order and share access

    Pick a plan and send us a login. Most projects start within the hour.

  2. 2

    Scan and baseline

    We scan files, users and settings and run a security test for a starting grade.

  3. 3

    Lock it down

    We set firewall rules, lock logins, fix file permissions and update core and plugins.

  4. 4

    Verify and report

    We re-scan, re-test logins and forms, and send your hardening report.

Harden it once, or stay protected

Pay once to harden a site, or host with us and get security built into every month.

Security Hardening

One-time fix

A full hands-on lockdown of your server, logins and WordPress.

How many sites?

$200$400$600$800$900one-timeone-time, $200 per siteone-time, $200 per siteone-time, $200 per siteone-time, $180 per site
  • Imunify360 deep scan
  • Cloudflare WAF rules tightened
  • Login and XML-RPC lockdown
  • File permission and ownership reset
  • Admin user and credential audit
  • Forced core and plugin updates
  • Post-hardening report
  • 1 month of free WP Farm hosting
Harden My Site

No commitment required. Includes the Secure or It’s Free Guarantee.

Managed WordPress Hosting

Risk-Free Trial

Security built in and kept current every month.

$35per month to start
  • Cloudflare WAF and CDN
  • Forced core updates
  • Weekly plugin and core updates
  • Daily offsite backups
  • Free site restoration
  • Free blacklist and penalty recovery
  • Free site migration
  • 24/7 WordPress experts
See Hosting Plans

Starter $35, Growth $55, Pro $120 per month

Secure, or you don’t pay

We scan your site before we start and again when we finish, and we test logins, forms and checkout after every change. If we can’t resolve the issue within the agreed scope of work, no charge is applied to your account.

The full Site Health lineup

Security Hardening is one of eight hands-on services, from tuning to recovery.

A plugin vulnerability surfaced and they audited, explained the risk, and fixed it, no downtime.
WP Farm customer

4.3 out of 5

Rated Excellent by our customers on Trustpilot.

Read Our Reviews

Questions before you order

Straight answers on risk, access and results.

Still unsure? Ask a WordPress expert

What is WordPress security hardening?

Changing settings at the server and in WordPress so common attacks fail: locked-down logins, safe file permissions, firewall rules and up-to-date software.

Is a security plugin enough?

A plugin runs inside WordPress, so attacks still reach your site before it can act. We add protection at Cloudflare’s edge and on the server, then tune WordPress on top.

Will hardening break my site?

We test logins, forms and checkout after every change. If a plugin needs XML-RPC or a file write to work, we allow just that.

Do I need to move my site to WP Farm?

No. We can harden WordPress on any host. Server rules like Imunify360 and file ownership depend on what your host allows, so every order includes a free month of WP Farm hosting to compare.

My site is already hacked. Is this the right service?

Start with hack cleanup so the attacker is removed first. Hardening is included after every cleanup.

Do you keep it hardened?

On WP Farm hosting we force core updates, keep firewall rules current and update plugins weekly. On other hosts, plan a check-up after big changes.

What if you can’t secure my site?

You don’t pay. That’s our Secure or It’s Free Guarantee. If we can’t resolve the issue within the agreed scope of work, no charge is applied to your account.

Ready to lock it down?

Start with a free security test, or book the hardening today. Secure or it’s free.

Harden My Site
Run a Free Security Test