WordPress hardening

Configure X-Frame-Options, CSP, HSTS and other security headers in .htaccess to protect your WordPress site.

Hide the WordPress login page behind a secret key, without a plugin Every bot on the internet knows /wp-login.php, and a new site gets password guessing attempts within hours. Moving or hiding the login page does not make passwords stronger, but it removes almost all of this automated noise: fewer requests, smaller logs, less load.…

Protect wp-config.php and xmlrpc.php with .htaccess wp-config.php is the most sensitive file of a WordPress site: the database name, user and password in plain text, the authentication keys and salts, the table prefix. Normally PHP executes the file and a direct request returns an empty page. But that depends on PHP working: if the PHP…

Control plugin and theme auto-updates with auto_update_plugin WordPress 5.5 added “Enable auto-updates” links to the Plugins and Themes screens: an administrator can switch automatic updates on per plugin or theme, and WordPress installs new versions in the background twice a day. The filters behind it, auto_update_plugin and auto_update_theme, have existed since WordPress 3.7, and they…

wp_kses(): allow exactly the HTML you need strip_tags() removes all HTML, including the bold text and links your users wanted to keep. wp_kses() works the other way round: it keeps only the tags and attributes on your list and removes everything else, including event attributes like onclick and dangerous URL protocols like javascript:. Core uses…

Sanitize or escape? Which WordPress function to use where WordPress has two families of functions for user data, and they are often mixed up. Sanitizing cleans data on the way in, before it is saved. Escaping makes data safe on the way out, for the exact place in the HTML where it is printed. They…

Must-use plugins (mu-plugins) in WordPress Besides normal plugins there is a second folder WordPress loads code from: wp-content/mu-plugins/. Files in it are “must-use” plugins: they are loaded on every request, before the normal plugins and the theme, and cannot be activated or deactivated in the admin.

Cannot add a featured image in WordPress: CSP unsafe-eval error If you suddenly can’t set a featured image, select files in the Media Library or pick images in ACF fields, and the browser console shows an error about unsafe-eval, the culprit is a Content Security Policy (CSP) that is too strict for the WordPress admin.

How to password-protect your entire WordPress site with .htaccess Sometimes the whole site has to be hidden from prying eyes, for example during development or on a staging server. The quickest and most reliable way is HTTP Basic Authentication with .htpasswd and .htaccess: the server asks for a login before WordPress even starts, and no…