How urgent is this? WordPress hardening is high priority. The majority of WordPress compromises exploit known vulnerabilities in outdated plugins or weak login configurations. These are well-documented attack vectors that are actively and routinely exploited.
Who does this?
The person responsible for managing the WordPress installation. This requires access to the WordPress admin dashboard and, for some steps, the hosting control panel.
Background
Risk
Why it matters
Outdated plugins / core
Most WP compromises exploit known vulnerabilities in outdated software
Unused plugins / themes
Inactive plugins are still an attack surface — even if not visible to visitors
Default admin username
The first username attackers try in brute-force attacks
Unprotected login page
wp-login.php is publicly accessible by default and a frequent target
XML-RPC enabled
/xmlrpc.php is a frequent target for brute-force and DDoS amplification attacks
Step 1: Update WordPress core, plugins, and theme
In the WordPress dashboard, go to Dashboard → Updates. Update:
WordPress core
All active plugins
The active theme
Make a backup before updating, especially for major WordPress version upgrades. Most hosting providers (including SiteGround) offer one-click backups.
Enable automatic updates where possible: go to Plugins → installed plugins and enable "Enable auto-updates" for each plugin.
Step 2: Remove unused plugins and themes
Go to Plugins → Installed Plugins and deactivate and delete any plugins that are not actively used. Deactivating alone is not sufficient — inactive plugins are still an attack surface.
Go to Appearance → Themes and delete any themes that are not in use. Keep only the active theme and optionally one default WordPress theme as a fallback.
Step 3: Check the admin username
Go to Users → All Users and check whether a user with the username admin exists.
If it does:
Create a new user with a different username and Administrator role
Log in with the new user
Delete the old admin user, assigning its content to the new user
Step 4: Protect the login page
Apply at least one of the following:
Option A — Two-factor authentication (2FA)
Install a plugin such as WP 2FA or Google Authenticator and require 2FA for all administrator accounts.
Option B — Rate limiting
Most security plugins (Solid Security, Wordfence) include login rate limiting — blocking an IP after a set number of failed attempts.
Option C — Relocate the login URL
Use a plugin like WPS Hide Login to change wp-login.php to a custom URL. This reduces automated attacks significantly.
Combining A and B is recommended.
Step 5: Disable XML-RPC if not needed
XML-RPC (/xmlrpc.php) is a legacy WordPress API. Unless you actively use it (e.g. for the Jetpack plugin or mobile app publishing), disable it.
Add the following to your .htaccess file, or use a security plugin (Solid Security, Wordfence) which includes an XML-RPC disable option:
<Files xmlrpc.php>
Order Deny,Allow
Deny from all
</Files>
To check if you use XML-RPC: if you don't use Jetpack, the WordPress mobile app, or any tool that requires it, you can safely disable it.
Step 6: Run WPScan periodically
WPScan scans your WordPress installation for known vulnerabilities in core, plugins, and themes. Run it at the following frequency:
Monthly for sites handling donations, payments, or personal data
Quarterly for informational sites without transactions
Also run it after any significant plugin or core update.
WPScan can be run via their hosted service at wpscan.com or via the command line using an API key (register for free at wpscan.com):
If WPScan reports the site is unavailable or blocking the scan, try one of the following:
Use an API key — register at wpscan.com and include --api-token YOUR-API-TOKEN in the command. Authenticated scans are less likely to be blocked by security plugins or firewalls.
Run from the server — if you have SSH access to the server, run WPScan locally. This bypasses external blocking entirely.
Use Patchstack as an alternative — Patchstack is a WordPress plugin that scans from within the installation. It is free for non-profits and is not affected by external firewalls.
Step 7: Verification
After completing all steps, verify:
Dashboard → Updates shows no pending updates
No unused plugins or themes remain installed
No user with username admin exists
Login page has 2FA and/or rate limiting active
/xmlrpc.php returns a 403 or 404 — test by visiting https://[yourdomain]/xmlrpc.php in a browser