Security Tips for WordPress Sites

Because WordPress is the most widely used content management system, it is also attackers' first target. The measures below greatly reduce the risk of your site being taken over. You can apply most of them in a few clicks with WP Toolkit in Plesk.

1. Updates and cleanup

• Core, themes and plugins: Old versions contain known vulnerabilities. You can turn on automatic updates in WP Toolkit.
• Delete what you do not use: Deactivated plugins and themes stay on the server and can still be exploited. Delete the ones you do not use completely.
• PHP version: Use a supported, current PHP version: How to change the PHP version
• Unneeded files: readme.html and license.txt in the main folder reveal your WordPress version; you can delete them.

2. Login security

• Username: Your administrator username should not be "admin". Attackers try this name first.
• Strong password and 2FA: Use a unique password of at least 12 characters and install a two-factor authentication (2FA) plugin.
• Limit login attempts: Use a security plugin that temporarily blocks IP addresses after repeated failed logins.
• Change the login URL: A plugin such as WPS Hide Login can change the wp-login.php address and cut down automated attacks.
• Block username scans: Attackers try to learn your username with yourdomain.com/?author=1. To block this: .htaccess tips for WordPress sites

3. Security measures with WP Toolkit

1. Log in to your Plesk panel at https://yourdomain.com:8443 or from the service page in your client area.
2. Find your site under WordPress and open the Security tab.
3. Tick the measures that are not applied yet and click Secure. Measures such as blocking access to wp-config.php, blocking directory browsing and disabling file editing in the dashboard are applied with one click.

If a plugin stops working after you apply a measure, you can revert the measure on the same screen.

4. File and database protection

• Disable file editing in the dashboard: Even if your admin area is compromised, theme and plugin code cannot be changed. Add these lines to wp-config.php:

define( 'DISALLOW_FILE_EDIT', true );
define( 'WP_DEBUG', false );
@ini_set( 'display_errors', 0 );

• Table prefix: On a new install, choose a prefix other than the default wp_ (for example wbev72_). Changing the prefix on an existing site means renaming every table; take a backup first.
• Ready-made template: wp-config security template

5. SSL, backups and a security plugin

• SSL: Install a free Let's Encrypt certificate and redirect all traffic to https://: Redirecting HTTP to HTTPS
• Backups: No measure saves you like a backup. Take regular backups in Plesk: How do I back up my website?
• Security plugin: Install only one of Wordfence, Solid Security or Sucuri. Several security plugins conflict with each other.

Protection on the server side

webevi servers run the ModSecurity web application firewall (WAF) and Fail2Ban. These tools block known attack patterns and IP addresses with repeated failed logins before they reach WordPress. If a legitimate action (such as saving a post) is blocked, open a support ticket and we will adjust the rule for your site.

Related articles: WordPress bot attacks, wp-cron.php tips