Website Hardening Guide: Defending Against Brute Force, Malware, and Exploits

Core Security Hardening Steps#

1. 1
   Protect wp-login.php: Limit login attempts using plugins like Wordfence or LiteSpeed Cache reCAPTCHA.
2. 2
   Disable XML-RPC: If you do not use the WordPress mobile app, block XML-RPC in .htaccess to prevent DDoS amplification:

<Files xmlrpc.php>
Order Allow,Deny
Deny from all
</Files>

1. 1
   Correct File Permissions: Folders must be 0755 and files 0644. Sensitive files like wp-config.php should be 0600 or 0640.
2. 2
   Virus Scanner: Run periodic scans in cPanel -> Virus Scanner to inspect public_html for known webshells and malware.