Back to Blog
WordPress Security Hardening: An Agency Guide
Filippo Tinnirello
A hacked client site is an agency nightmare. Security is not an "add-on"—it's a fundamental part of the build process.
Beyond "Install Wordfence"
While plugins help, true security starts at the server and code level.
- Disable XML-RPC: Prevents brute force attacks.
- Two-Factor Authentication (2FA): Enforce 2FA for all admin users. It's the single most effective protection against compromised passwords.
- File Permissions: Ensure `wp-config.php` is strictly locked down (400 or 440).
The "Principle of Least Privilege"
Don't give "Administrator" access to the client unless necessary. Create an "Editor" role that can manage content but not break the site or install untested plugins.
Secure by Default
Every site I build comes hardened out of the box. No extra setups, just peace of mind for you and your clients.