Hardening WordPress: 9 Settings Most Store Owners Never Change

WordPress ships tuned for a smooth first install, not a safe fifth year. Its defaults are publicly documented, which means every attacker knows them by heart. Here are nine settings worth changing this week.

Retire the admin username — and hide your real one

Two changes. First, if your administrator account is literally named admin, create a new administrator under a different name and delete the old one — bots try admin against every WordPress site they find. Second, set the Nickname field in your profile to something different from your login name, because WordPress otherwise prints the real username in author pages and bylines for anyone to harvest.

Change the database table prefix

Every default install creates tables starting with wp_, and automated SQL injection scripts are written against those exact names. A custom prefix — set during install, or migrated later with a security plugin — makes canned attacks miss. It won't stop a patient human, but most attacks aren't humans.

Turn off XML-RPC

This legacy API lets one request test hundreds of password guesses through its system.multicall method — brute force with a megaphone. Unless you depend on old remote-publishing apps or a legacy Jetpack connection, disable it entirely with a plugin or a server rule and watch your login noise drop.

Disable file editing from the dashboard

Two lines in wp-config.php. Setting DISALLOW_FILE_EDIT to true removes the built-in theme and plugin code editor, so a hijacked admin session can't plant malware in two clicks. The stricter DISALLOW_FILE_MODS also blocks plugin and theme installs — a good fit for finished sites that rarely change.

Move the login page and cap the attempts

Renaming wp-login.php to a custom slug cuts automated traffic dramatically, and a limit-login-attempts plugin locks an address out after repeated failures — five tries and a 20-minute timeout is a sane starting point. Together they turn a firehose of guesses into a trickle you can actually monitor.

Stop advertising your version number

By default WordPress prints its exact version in your page source, letting bots pair your site with the known exploits for that release. Remove the generator tag with a small snippet or plugin, and while you're in there confirm directory browsing is off so your uploads folder doesn't list its contents to strangers.

Hardened settings drift — a migration, a new plugin, or a helpful contractor can quietly undo any of these. Trust Guard's recurring security scans catch the regressions and the vulnerabilities they expose, so the hardening you did this week is still there next year.