Skip to content

Guides

WordPress security guides that get to the point

Step-by-step guides to hardening, sign-in protection, malware, backups and recovery. Written for site owners, precise enough for developers, and useful whichever plugin you run.

All WordPress security guides

Everyone 9 min read

How to Hide wp-login.php on a WordPress Site

Learn how to hide wp-login.php, what it protects you from, two ways to do it and how to avoid locking yourself out. Plain steps for any WordPress site.

Read the guide
Everyone 12 min read

The WordPress Hardening Checklist for 2026

A practical WordPress hardening checklist: updates, accounts, login, files, headers, backups and monitoring, in the order that closes the most doors first.

Read the guide
Everyone 14 min read

How to Recover a Hacked WordPress Site

Need to recover a hacked WordPress site? Follow this calm, ordered plan: contain the damage, clean the files, reset every secret and close the hole.

Read the guide
Everyone 9 min read

WordPress Two-Factor Authentication: A Practical Setup Guide

Set up WordPress two-factor authentication properly: choose a method, roll it out to the right users, handle lost phones and avoid the gaps that bypass it.

Read the guide
Everyone 10 min read

How to Stop Brute Force Attacks on WordPress

How to stop brute force attacks on WordPress with lockouts, two-factor, server rate limits and the real visitor IP behind a CDN. Clear steps for any site.

Read the guide
Developers 10 min read

WordPress Security Headers: What to Add and How

Add WordPress security headers safely: X-Frame-Options, nosniff, Referrer-Policy, HSTS and CSP, with Apache and nginx examples and testing tips.

Read the guide
Everyone 10 min read

How to Scan WordPress for Malware

How to scan WordPress for malware with a plugin and by hand: core checksums, signatures, suspicious files, false positives and what to do with each finding.

Read the guide
Everyone 10 min read

A WordPress Backup Strategy That Actually Works

Build a WordPress backup strategy that works: what to back up, how often, where to store it, how to test a restore and how to protect your copies.

Read the guide
Developers 10 min read

wp-config.php Hardening and WordPress File Permissions

A practical guide to wp-config.php hardening: safe file permissions, useful security constants, blocking direct access and keeping PHP out of uploads.

Read the guide
Owners 11 min read

WordPress Security Checklist for Agencies

A WordPress security checklist for agencies: one baseline for every client site, plus access control, updates, backups, monitoring and an incident plan.

Read the guide
Developers 8 min read

How to Disable XML-RPC in WordPress (and When Not To)

Should you disable XML-RPC in WordPress? Learn what xmlrpc.php does, why attackers use it, who still needs it and three safe ways to turn it off.

Read the guide
Developers 8 min read

WordPress User Enumeration: What It Is and How to Stop It

WordPress user enumeration lets anyone list your usernames. Learn the four ways it leaks, how to test your site and how to stop it with code or a plugin.

Read the guide

Questions

WordPress security guides: questions

Who are these WordPress security guides for?

Site owners who want plain steps, and developers who want the exact constants, headers and server rules. Each guide says who it is mainly for.

Do the guides only work with Stack Guard?

No. Every guide explains the problem and how to fix it by hand. A short box at the end says how Stack Guard handles it, if you would rather switch it on.

How often are the WordPress security guides updated?

When WordPress, browsers or common attacks change in a way that affects the advice. Each guide shows the date it was last checked.

Rather switch it on than set it up by hand?

Stack Guard Free covers most of these guides with one switch each.

Download FreeCheck My Site