--- title: Securing and hardening Wordpress description: This guide includes a number of WordPress post-installation steps to further improve the security of your site. --- [Skip to content](https://help.blakemarkdigital.co.uk/securing-and-hardening-wordpress#main-content) English - United Kingdom Show submenu for translations [More support](https://help.blakemarkdigital.co.uk/kb-tickets/new) [Support Portal](https://help.blakemarkdigital.co.uk/support-portal) [![Blake Mark Digital Logo](https://help.blakemarkdigital.co.uk/hs-fs/hubfs/Asset%205.png?width=200&height=57&name=Asset%205.png)](https://blakemarkproductions.com/) Open main navigation Close main navigation - English - United Kingdom Show submenu for translations - [More support](https://help.blakemarkdigital.co.uk/kb-tickets/new) - [Support Portal](https://help.blakemarkdigital.co.uk/support-portal) - [Contact Support](https://help.blakemarkproductions.com/support-portal) [Contact Support](https://help.blakemarkproductions.com/support-portal) How can we help you? - There are no suggestions because the search field is empty. 1. [Knowledge Base](https://help.blakemarkdigital.co.uk/) 2. [Web Hosting](https://help.blakemarkdigital.co.uk/web-hosting) # Securing and hardening Wordpress This guide includes a number of WordPress post-installation steps to further improve the security of your site. We are making some assumptions in this guide: - That before installing WordPress you enabled SSL on your domain (using [LetsEncrypt](https://help.blakemarkdigital.co.uk/how-do-i-get-a-free-lets-encrypt-ssl-certificate-for-my-website)) and then you selected the HTTPS variant of your sites name when you performed the WordPress install. - That you have installed WordPress using [Softaculous](https://help.blakemarkdigital.co.uk/how-to-install-wordpress-using-softaculous) - That you have the [LiteSpeed caching plugin installed](https://help.blakemarkdigital.co.uk/how-to-install-the-wordpress-litespeed-cache-plugin) - it is installed as standard if you used Softaculous.   We generally recommend that you minimise the number of plugins you install - for a number of reasons: - The more plugins, the more WordPress has to process to actually display your site - often resulting in a slower site. - The more plugins you use, the more likely you are to be exposed to an issue with a plugin being poorly coded and having a "soft target" that can be easily exploited resulting in your site being compromised. - Always check that any plugins you do use are well supported and regularly updated - Good reviews are a great indicator! That said, the following plugins provide a layer of protection for your site that is well worth having. 1. Install a WordPress Application Firewall (WAF) - we suggest either [WordFence](https://en-gb.wordpress.org/plugins/wordfence/) or [Sucuri](https://en-gb.wordpress.org/plugins/sucuri-scanner/). Both of these are well regarded and have a wealth of options built in that you can enable to enhance your site's security. They also have paid versions with additional features. 2. Add Two-Factor Authentication (2FA) - this adds security to the WordPress login - so that anyone attempting to login requires either a SMS text message authentication or a code from an app on their mobile phone. [WordFence](https://en-gb.wordpress.org/plugins/wordfence/), mentioned above has 2FA options built in. An alternative would be [Google Authenticator](https://en-gb.wordpress.org/plugins/google-authenticator/) - which works alongside [Authy](https://authy.com/). ### Updates to .htaccess These snippets - which you can pick and choose from - harden and protect access to your site and it's files. `.htaccess` files are special, for several reasons: - The full stop in front of their names makes them hidden - so if you're using [cPanel File Manager](https://help.blakemarkdigital.co.uk/using-cpanel-file-manager) you'll need to make sure you have view hidden files enabled. - They can be placed in any directory (just create a new file called `.htaccess` if it doesn't already exist) to perform actions on incoming requests to that directory and any sub-folders But, be warned - `.htaccess` files are super-fragile - one misplaced full stop or other character could break access to your whole site. Make sure you always take a backup of the file before making any changes, so you can revert easily if there is ever an issue. To use these snippets simply copy and paste the code blocks for those you'd like to implement into your `.htaccess` file. The `.htaccess` file for your site is found in the sites docroot (usually `/public_html` if you've setup WordPress in your primary domain). You can access and edit your `.htaccess` file using the [cPanel File Manager](https://help.blakemarkdigital.co.uk/using-cpanel-file-manager).  The lines beginning `#` are comments to explain what the following lines do. #### Protect your `.htaccess` file ``` # Deny access to .htaccess Order allow,deny Deny from all ``` #### Protect your wp-config.php file ``` # Block access to wp-config.php order allow,deny deny from all ``` #### Block access to your includes files ``` # Block the include-only files. RewriteEngine On RewriteBase / RewriteRule ^wp-admin/includes/ - [F,L] RewriteRule !^wp-includes/ - [S=3] RewriteRule ^wp-includes/[^/]+\.php$ - [F,L] RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F,L] RewriteRule ^wp-includes/theme-compat/ - [F,L] ``` #### Disable directory browsing ``` # Disable directory browsingOptions All -Indexes ``` #### Block XML-RPC requests ``` ​# Block any attempted XML-RPC requests order deny,allow deny from all ```   - [Getting Started](https://help.blakemarkdigital.co.uk/getting-started) - [Web Hosting](https://help.blakemarkdigital.co.uk/web-hosting#main-content) - [Elementor](https://help.blakemarkdigital.co.uk/web-hosting#elementor) - [WordPress](https://help.blakemarkdigital.co.uk/web-hosting#wordpress) - [Security](https://help.blakemarkdigital.co.uk/web-hosting#security) - [Email](https://help.blakemarkdigital.co.uk/email#main-content) - [Mail Clients](https://help.blakemarkdigital.co.uk/email#mail-clients) - [SpamExperts](https://help.blakemarkdigital.co.uk/email#spamexperts) - [MailChannels](https://help.blakemarkdigital.co.uk/email#mailchannels) - [Domains](https://help.blakemarkdigital.co.uk/domains#main-content) - [Domain Privacy](https://help.blakemarkdigital.co.uk/domains#domain-privacy) - [Billing](https://help.blakemarkdigital.co.uk/billing) - [cPanel](https://help.blakemarkdigital.co.uk/cpanel#main-content) - [JetBackup](https://help.blakemarkdigital.co.uk/cpanel#jetbackup) - [Softaculous](https://help.blakemarkdigital.co.uk/cpanel#softaculous) - [WordPress Glossary Terms](https://help.blakemarkdigital.co.uk/wordpress-glossary-terms#main-content) - [H](https://help.blakemarkdigital.co.uk/wordpress-glossary-terms#h) [![Blake Mark Digital Logo](https://help.blakemarkdigital.co.uk/hs-fs/hubfs/Asset%205.png?width=250&height=71&name=Asset%205.png "Blake Mark Digital Logo")](https://blakemarkdigital.co.uk/) Blake Mark Digital is a digital marketing agency supporting SMEs and non-profits with strategic branding, content, and campaigns that drive real results 124-128 City Road, London, EC1V 2NX [support@blakemarkdigital.co.uk](mailto:support@blakemarkdigital.co.uk) +44 20 4578 9582 [mailto:support@blakemarkproductions.com](mailto:support@blakemarkproductions.com) Copyright © Blake Mark Productions Ltd