Secure your WordPress site with WP Toolkit security measures

WP Toolkit in cPanel can apply a set of security settings to your WordPress site with a few clicks. These "security measures" close off common ways attackers get in, such as directory browsing, loose file permissions and the built-in file editor. They take a few minutes to apply and are well worth doing on every WordPress site, especially one that has been hacked before.

This guide explains how to apply them safely, and what to do if one causes a problem.

Before you start

• Make sure you have a recent backup. We take daily backups of cPanel hosting accounts, and you can restore them yourself. See Restore files, databases or email from a backup (JetBackup).
• Update first. Update WordPress, your plugins and your theme before hardening. Security measures help, but they don't replace keeping everything up to date.
• Pick a quiet time. A small number of measures can stop an older plugin or theme from working, so apply them when you have time to test the site afterwards.

Step 1: Open WP Toolkit

1. Go to Services → My Services (https://www.hooplahosting.co.nz/client/clientarea.php?action=services), open your hosting service and click Log in to cPanel.
2. Find WP Toolkit on the cPanel home page (you can type "WP Toolkit" in the search box at the top).
3. Find your website in the list.

Next to each site, WP Toolkit shows a security status. Fix Security means important (critical) measures haven't been applied yet. Check Security means the critical ones are done, but some extra measures are still available.

Step 2: Apply the security measures

1. Click the security status for your site (Fix Security or Check Security). You can also click Apply critical security measures under the Security heading on the site's card.
2. You'll see a list of measures, with a tick beside the ones already applied.
3. Start with the measures marked as critical or recommended. Tick them and click Secure.
4. Open your website in a private (incognito) browser window and check it works: the home page, a few inner pages, your contact form, and the shop checkout or member login if you have them. Also log in to the WordPress dashboard to check it still loads.
5. If everything works, go back and apply the remaining measures a few at a time, testing after each batch.

Applying measures a few at a time makes it easy to tell which one caused a problem if something stops working.

Measures worth knowing about

• Restrict access to files and directories. Sets your WordPress files to the standard safe permissions (644 for files, 755 for folders and 600 for wp-config.php). WP Toolkit labels this one "cannot be reverted" because there's no Revert button for it. It's safe to apply on a normal WordPress site, and the permissions can still be changed back by hand if a developer ever needs to.
• Block directory browsing. Stops visitors seeing a list of the files in your folders.
• Forbid execution of PHP files in places like the uploads folder. Attackers often hide malicious scripts there. Occasionally a badly written plugin relies on running PHP from these folders.
• Disable the file editor in the dashboard. Stops anyone who gets into WordPress from editing your theme and plugin code from the browser.
• Change the default administrator username if your site still has a user called admin. Attackers try this username first.
• Block access to xmlrpc.php. This blocks a common brute-force target. It can stop the WordPress mobile app, Jetpack and some other remote tools working, so skip it if you rely on those.
• Bot protection. Blocks known bad bots from crawling your site.

The exact list can vary slightly depending on your WordPress version and site setup. WP Toolkit shows a short description of each measure when you hover over or expand it.

Securing several sites at once

If you have more than one WordPress site in your cPanel account, click the Security tab at the top of WP Toolkit, tick the sites you want, click Secure and choose the measures to apply. We recommend doing this for all your sites, not just one that has had trouble. Test each site afterwards.

If something stops working

1. Go back to WP Toolkit and open the security status for the site.
2. Tick the measure you applied most recently and click Revert.
3. Check the site again. Once you've found the measure that caused the problem, leave it off and ask your developer whether the plugin or theme involved can be updated or replaced.

Other things that make a big difference

• Turn on automatic updates in WP Toolkit for WordPress, plugins and themes. Out-of-date plugins are the most common way sites get hacked.
• Remove plugins and themes you don't use. Inactive ones can still be attacked.
• Keep admin users to a minimum and remove anyone who no longer needs access.
• Use a security plugin such as Wordfence for two-factor login and scanning.
• Turn on two-factor authentication for cPanel. See Turn on two-factor authentication for cPanel.

If your site has already been hacked, start with My WordPress website has been hacked: what to do, then come back and apply these measures once it's clean. If you're getting "Site vulnerabilities found" emails, see WP Toolkit security alert emails: what do they mean?

Not sure whether a measure is safe for your site? Open a support ticket and we'll take a look.