Secure WordPress After a Hack: 12 Essential Measures

# Change password for all administrators
wp user list --role=administrator --field=ID --path=/var/www/html | while read id; do
  NEW_PASS=$(openssl rand -base64 24)
  wp user update $id --user_pass="$NEW_PASS" --path=/var/www/html
  echo "User $id: password updated"
done

# 1. Change MySQL password
mysql -u root -p -e "ALTER USER 'wp_user'@'localhost' IDENTIFIED BY 'NewComplexPassword_2026!';"
 
# 2. Update wp-config.php with the new password
wp config set DB_PASSWORD 'NewComplexPassword_2026!' --path=/var/www/html

# Automatically regenerate all keys
wp config shuffle-salts --path=/var/www/html

# Install ModSecurity on Apache
sudo apt install libapache2-mod-security2
sudo a2enmod security2
 
# Download OWASP CRS rules
cd /etc/modsecurity/
sudo git clone https://github.com/coreruleset/coreruleset.git
sudo cp coreruleset/crs-setup.conf.example coreruleset/crs-setup.conf
 
# Enable rules in Apache configuration
sudo cat >> /etc/apache2/mods-enabled/security2.conf << 'EOF'
IncludeOptional /etc/modsecurity/coreruleset/crs-setup.conf
IncludeOptional /etc/modsecurity/coreruleset/rules/*.conf
EOF
 
sudo systemctl restart apache2

# Install the Two-Factor plugin
wp plugin install two-factor --activate --path=/var/www/html

<?php
// Force 2FA for administrators
add_filter('two_factor_providers', function($providers) {
    // Keep only TOTP and backup codes
    return array(
        'Two_Factor_Totp'          => $providers['Two_Factor_Totp'],
        'Two_Factor_Backup_Codes'  => $providers['Two_Factor_Backup_Codes'],
    );
});

cd /var/www/html
 
# Directory permissions
find . -type d -exec chmod 755 {} \;
 
# File permissions
find . -type f -exec chmod 644 {} \;
 
# Restrictive permissions for wp-config.php
chmod 400 wp-config.php
 
# Restrictive permissions for .htaccess
chmod 444 .htaccess
 
# Correct ownership (replace www-data with your web user)
chown -R www-data:www-data /var/www/html/

# wp-content/uploads/.htaccess
<FilesMatch "\.(?:php|phtml|php5|php7|phps)$">
  Order Allow,Deny
  Deny from all
</FilesMatch>

location ~* /wp-content/uploads/.*\.php$ {
    deny all;
}

# Add to wp-config.php
wp config set DISALLOW_FILE_EDIT true --raw --path=/var/www/html

# Prevent plugin/theme installation and updates from the dashboard
wp config set DISALLOW_FILE_MODS true --raw --path=/var/www/html

# Prevent direct access to wp-config.php
<Files wp-config.php>
  Order Allow,Deny
  Deny from all
</Files>

location ~ /wp-config\.php$ {
    deny all;
}

# Move wp-config.php above the web root
mv /var/www/html/wp-config.php /var/www/wp-config.php

# Force HTTPS
wp config set FORCE_SSL_ADMIN true --raw --path=/var/www/html
 
# Disable debug in production
wp config set WP_DEBUG false --raw --path=/var/www/html
wp config set WP_DEBUG_DISPLAY false --raw --path=/var/www/html
wp config set WP_DEBUG_LOG false --raw --path=/var/www/html

# Protect .htaccess itself
<Files .htaccess>
  Order Allow,Deny
  Deny from all
</Files>
 
# Prevent directory listing
Options -Indexes
 
# Block access to sensitive files
<FilesMatch "(^\.ht|wp-config\.php|readme\.html|license\.txt|xmlrpc\.php)">
  Order Allow,Deny
  Deny from all
</FilesMatch>
 
# Block PHP execution in wp-includes
<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteBase /
  RewriteRule ^wp-admin/includes/ - [F,L]
  RewriteRule !^wp-includes/ - [S=3]
  RewriteRule ^wp-includes/[^/]+\.php$ - [F,L]
  RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F,L]
  RewriteRule ^wp-includes/theme-compat/ - [F,L]
</IfModule>
 
# Block PHP execution in wp-includes (alternative)
<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteCond %{SCRIPT_FILENAME} !^(.*)wp-includes/ms-files.php
  RewriteRule ^wp-includes/[^/]+\.php$ - [F,L]
</IfModule>
 
# Block suspicious query strings
<IfModule mod_rewrite.c>
  RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR]
  RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
  RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2})
  RewriteRule ^(.*)$ index.php [F,L]
</IfModule>

# Completely block access to xmlrpc.php
<Files xmlrpc.php>
  Order Allow,Deny
  Deny from all
</Files>

<?php
// Add to functions.php or a mu-plugin
add_filter('xmlrpc_enabled', '__return_false');
 
// Remove the X-Pingback header
add_filter('wp_headers', function($headers) {
    unset($headers['X-Pingback']);
    return $headers;
});
 
// Disable all XML-RPC methods
add_filter('xmlrpc_methods', function($methods) {
    return array();
});

location = /xmlrpc.php {
    deny all;
    access_log off;
    log_not_found off;
}

# Install and activate the plugin
wp plugin install limit-login-attempts-reloaded --activate --path=/var/www/html

# Limit wp-login.php access by IP address
<Files wp-login.php>
  Order Deny,Allow
  Deny from all
  # Allow your IP (replace with your IP)
  Allow from 203.0.113.42
  Allow from 198.51.100.0/24
</Files>

# Install WPS Hide Login
wp plugin install wps-hide-login --activate --path=/var/www/html
 
# Configure the new login URL
wp option update whl_page 'my-secure-access' --path=/var/www/html

<IfModule mod_headers.c>
  # Force HTTPS for 1 year
  Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
 
  # Prevent clickjacking
  Header always set X-Frame-Options "SAMEORIGIN"
 
  # Prevent MIME sniffing
  Header always set X-Content-Type-Options "nosniff"
 
  # Referrer policy
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
 
  # Permissions policy
  Header always set Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()"
 
  # Content Security Policy (adjust for your site)
  Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://www.google-analytics.com https://www.googletagmanager.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https://www.google-analytics.com;"
</IfModule>

# Security headers
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()" always;

# Check HTTP headers
curl -I https://your-site.com
 
# Or use an online service like securityheaders.com

# Create a comprehensive monitoring script
cat > /usr/local/bin/wp-security-monitor.sh << 'SCRIPT'
#!/bin/bash
SITE_PATH="/var/www/html"
LOG="/var/log/wp-security.log"
ALERT_EMAIL="admin@your-site.com"
 
echo "=== Security scan - $(date) ===" >> $LOG
 
# 1. Verify core file integrity
echo "[Core Checksums]" >> $LOG
wp core verify-checksums --path=$SITE_PATH >> $LOG 2>&1
 
# 2. Verify plugin integrity
echo "[Plugin Checksums]" >> $LOG
wp plugin verify-checksums --all --path=$SITE_PATH >> $LOG 2>&1
 
# 3. PHP files in uploads
echo "[PHP in Uploads]" >> $LOG
PHP_IN_UPLOADS=$(find $SITE_PATH/wp-content/uploads/ -name "*.php" -type f 2>/dev/null)
if [ -n "$PHP_IN_UPLOADS" ]; then
  echo "ALERT: PHP files found in uploads:" >> $LOG
  echo "$PHP_IN_UPLOADS" >> $LOG
  echo "$PHP_IN_UPLOADS" | mail -s "SECURITY ALERT: PHP in uploads" $ALERT_EMAIL
fi
 
# 4. Files modified in the last 24 hours
echo "[Recently modified files]" >> $LOG
find $SITE_PATH -name "*.php" -mtime -1 -type f >> $LOG 2>&1
 
# 5. New admin accounts
echo "[Admin accounts]" >> $LOG
wp user list --role=administrator --path=$SITE_PATH --format=table >> $LOG 2>&1
 
echo "=== End of scan ===" >> $LOG
SCRIPT
 
chmod +x /usr/local/bin/wp-security-monitor.sh
 
# Schedule a daily scan
(crontab -l 2>/dev/null; echo "0 4 * * * /usr/local/bin/wp-security-monitor.sh") | crontab -

#!/bin/bash
# WordPress post-hack hardening script
SITE_PATH="/var/www/html"
 
echo "=== WordPress Hardening ==="
 
# Regenerate security keys
wp config shuffle-salts --path=$SITE_PATH
echo "[OK] Security keys regenerated"
 
# Disable file editor
wp config set DISALLOW_FILE_EDIT true --raw --path=$SITE_PATH
echo "[OK] File editor disabled"
 
# Force HTTPS
wp config set FORCE_SSL_ADMIN true --raw --path=$SITE_PATH
echo "[OK] HTTPS forced for admin"
 
# Disable debug
wp config set WP_DEBUG false --raw --path=$SITE_PATH
echo "[OK] Debug mode disabled"
 
# File permissions
find $SITE_PATH -type d -exec chmod 755 {} \;
find $SITE_PATH -type f -exec chmod 644 {} \;
chmod 400 $SITE_PATH/wp-config.php
chmod 444 $SITE_PATH/.htaccess
echo "[OK] File permissions corrected"
 
# Install and activate security plugins
wp plugin install two-factor --activate --path=$SITE_PATH
wp plugin install limit-login-attempts-reloaded --activate --path=$SITE_PATH
echo "[OK] Security plugins installed"
 
# Update everything
wp core update --path=$SITE_PATH
wp plugin update --all --path=$SITE_PATH
wp theme update --all --path=$SITE_PATH
echo "[OK] WordPress and extensions updated"
 
echo "=== Hardening complete ==="