• Wordpress

Raj Thilak

September 2, 2026

.

6 Min read

Agencies managing dozens of WordPress sites carry a different level of security responsibility than someone running a single personal blog. One compromised client site can mean a damaged reputation, hours of unplanned cleanup work, and in some cases a client relationship that never fully recovers. Hardening WordPress properly does not require exotic tools, but it does require a consistent checklist applied to every site rather than a one off security pass that only happens after something goes wrong.

Start With Login Hardening

Brute force login attempts remain one of the most common attack vectors against WordPress sites, largely because they are cheap and easy to automate at scale. Rename the default admin username away from anything predictable, enforce strong passwords across every client account, and add two factor authentication for any account with publishing or administrative access. Limiting login attempts through a security plugin or server level rule also stops most automated brute force attempts before they get anywhere near guessing a real password.

Keep Core, Themes, and Plugins Updated Without Exception

Outdated plugins are the single largest source of WordPress vulnerabilities reported each year, and agencies managing many sites are often the ones most tempted to delay updates out of fear of breaking a client site. The better approach is a staged process: apply updates to a staging environment first, confirm nothing breaks, then push to production on a predictable schedule rather than reactively after a vulnerability is already being exploited in the wild.

Audit Installed Plugins Regularly

Every additional plugin is additional attack surface, and agencies that inherit client sites often find a long tail of unused, outdated plugins sitting dormant but still technically active. A quarterly audit that removes anything not actively in use, and flags anything without a recent update from its developer, meaningfully reduces the number of ways a site can be compromised without requiring constant vigilance.

Legacy Site Cleanup Before Applying a Hardening Pass

Older client sites inherited from a previous agency or an in house team often carry accumulated cruft: abandoned plugins, unused user accounts from former staff, and admin credentials that were never rotated after a handoff. A hardening pass on a legacy site should start with this cleanup, since applying strong login policies and a firewall on top of a site still carrying dormant accounts and unknown plugins only partially closes the actual attack surface.

Configure a Web Application Firewall

A properly configured WAF filters out a large share of common attack patterns, including SQL injection attempts and known exploit signatures, before they ever reach WordPress itself. Whether implemented through a hosting provider’s built in firewall, a dedicated security plugin, or a service in front of the server, a WAF is one of the highest leverage single additions an agency can make across an entire portfolio of client sites at once.

Restrict File Editing and Execution Permissions

WordPress allows theme and plugin file editing directly from the admin dashboard by default, which is convenient during development but represents a real risk if an attacker gains access to a lower privileged account. Disabling file editing from wp-config.php, and restricting PHP execution in the uploads directory, closes off two of the more common paths attackers use to establish persistence after an initial compromise.

The checklist below summarises the hardening steps in rough priority order for a first pass audit.

Set Up Automated, Tested Backups

Security hardening reduces the likelihood of a compromise, but it does not eliminate it, which is why a tested backup process matters just as much as prevention. Automated daily backups stored off the primary server, with a periodic restore test to confirm they actually work, turn a potential multi day recovery scramble into a same day fix. Agencies that skip the restore test often discover their backup process was broken only when they actually needed it.

Monitor for Unusual Activity Across the Whole Portfolio

For agencies managing many sites, centralised monitoring that flags unusual login patterns, unexpected file changes, or sudden traffic spikes across the entire client portfolio catches problems far earlier than checking each site individually on an ad hoc basis. Several security plugins and hosting dashboards offer portfolio level views built specifically for agencies managing multiple WordPress installs, which is worth setting up once rather than repeating the same manual check across every site every week.

Building an Incident Response Plan for Compromised Sites

Despite best efforts at hardening, agencies should still prepare for the possibility of a successful compromise with a documented response plan. This includes knowing exactly who to contact, how quickly a clean backup can be restored, and how to communicate with the affected client during the incident. Agencies with a rehearsed response plan typically resolve a compromise within hours, while those without one often spend a full day or more simply figuring out the right sequence of steps while the client site remains vulnerable.

Documentation Habits That Support the Checklist

Beyond writing down the process itself, agencies benefit from keeping a per site security log noting when updates were applied, when the last plugin audit happened, and any incidents that occurred, however minor. This log becomes invaluable during a client handoff, a team change, or when trying to identify a pattern across multiple sites that might indicate a shared vulnerability rather than an isolated incident.

Document the Process So It Survives Team Changes

A hardening checklist that lives only in one team member’s head disappears the moment that person moves on. Writing the process down, including which plugins are approved, how updates are staged and tested, and who owns the quarterly plugin audit, keeps security consistent even as an agency’s team composition changes over time. This documentation also makes onboarding new client sites faster, since the same checklist applies regardless of which developer picks up the work.

Askan Technologies’ WordPress development services fold this checklist into every client engagement by default, and the team’s Magento security patching work follows a similar staged update process for agencies running mixed CMS portfolios.

For teams wanting an authoritative reference beyond agency practice, the WordPress.org hardening documentation is maintained directly by the core WordPress team and is worth bookmarking alongside any internal checklist.