WordPress security: the five fixes that matter most

Keep WordPress, plugins and themes updated

Security fixes for WordPress and its plugins are published openly, so bots start trying them on old sites within days. Updating is the single most effective thing you can do.

Take a backup first (most hosts offer one click), update WordPress, then plugins and your theme, and check the site still works. Delete plugins and themes you no longer use: deactivated code can still be attacked.

How to fix it on WordPress

1. Back up your site (most hosts have a one-click backup).
2. Go to Dashboard > Updates and update WordPress, then your plugins and theme.
3. Turn on automatic updates for minor releases.

Move to a supported PHP version

PHP is the language WordPress runs on. Old versions get no security fixes at all, so new bugs stay open forever. Your host's control panel lets you change the version; update WordPress and plugins first so they support the new one.

How to fix it on WordPress hosting

1. Take a full backup first.
2. In your hosting control panel find 'PHP version' (cPanel: 'Select PHP Version' or 'MultiPHP Manager') and choose PHP 8.3 or newer.
3. Update WordPress, your theme, and plugins first so they support the new PHP version, then check the site still works.

Turn off XML-RPC if you don't use it

XML-RPC is an old way for apps to talk to WordPress. Attackers like it because one request can try hundreds of passwords. If you don't use the WordPress mobile app or Jetpack, block it.

How to fix it on WordPress

1. Unless you use the WordPress mobile app or Jetpack, block XML-RPC in .htaccess:
2. Or add add_filter('xmlrpc_enabled', '__return_false'); to functions.php.

<Files xmlrpc.php>
  Require all denied
</Files>

Hide your user list

By default, WordPress lists every author's username at /wp-json/wp/v2/users. That hands bots half of every login, so they only need to guess passwords. The snippet below hides the list from anyone not logged in.

How to fix it on WordPress

1. Add this to your theme's functions.php (or a small code-snippets plugin) so the user list is only visible to logged-in users.
2. Also use strong passwords and a login-limiting plugin.

add_filter('rest_endpoints', function ($endpoints) {
    if (!is_user_logged_in()) {
        unset($endpoints['/wp/v2/users']);
        unset($endpoints['/wp/v2/users/(?P<id>[\d]+)']);
    }
    return $endpoints;
});

Stop advertising your WordPress version

WordPress adds its version number to every page, which tells attackers exactly which known bugs to try. Hiding it is a small extra; staying updated is what actually protects you.

How to fix it on WordPress

1. Keep WordPress updated (Dashboard > Updates). To stop advertising the version, add this to functions.php:

remove_action('wp_head', 'wp_generator');
add_filter('the_generator', '__return_empty_string');