Launch day is exciting. It’s also the moment your site becomes a public target. The good news: most successful WordPress attacks are preventable. WordPress powers 43% of the internet, making it both the world’s most popular CMS and its biggest target — and the old “install a security plugin and forget” approach is a recipe for disaster. The steps below are practical, ordered by impact, and designed to be completed before you go live.
Why Pre-Launch Security Matters
Overall, 11,334 new vulnerabilities were found in the WordPress ecosystem in 2025 — a 42% increase compared to 2024. Attacks are not random. Hackers increasingly leverage artificial intelligence and automation to identify and exploit vulnerable WordPress sites, with AI tools scanning thousands of websites in seconds, identifying sites with outdated core software, plugins, themes, and exposed configuration files.
A hacked WordPress website can cause serious damage to your business’s revenue and reputation. Hackers can steal user information and passwords, install malicious software, and even distribute malware to your users. Worse, you may find yourself paying ransomware to hackers just to regain access to your website.
Building your defenses in from day one is far cheaper than cleaning up after a breach. Here’s your pre-launch checklist.
1. Choose a Host That Takes Security Seriously
Your WordPress hosting service plays the most important role in the security of your WordPress site. A good shared hosting provider takes extra measures to protect their servers against common threats. Look for a host that actively monitors for suspicious activity, keeps server software and PHP versions current, and provides DDoS mitigation at the infrastructure level. Our WordPress hosting is built with these protections layered in from the start — not bolted on as an afterthought. See our pricing page for plan details.
2. Install and Force HTTPS with a Valid SSL Certificate
There is no acceptable reason for any WordPress site to operate on HTTP. Beyond the security risk, Google has marked HTTP sites as “Not Secure” in Chrome since 2018, and uses HTTPS as a ranking signal — running HTTP actively hurts both your security and your SEO.
Once your SSL certificate is installed, force HTTPS site-wide. In Settings → General, update both URL fields to https://. Then add a redirect to your .htaccess file:
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]Confirm there are no mixed-content warnings before flipping the site live.
3. Ditch the Default “admin” Username
One default value you should always change is the admin username. The username “admin” is one of the first usernames bad actors try in a brute-force attack — if you use it, it halves the effort they need to go through to guess the correct credentials.
Usernames cannot be changed in WordPress directly. Your best course of action is to create a new administrator user with a unique username and then delete the old one. Also update your public display name so it doesn’t expose your login username to the world.
4. Use Strong, Unique Passwords and Enable 2FA
Weak passwords remain one of the most persistent and preventable WordPress vulnerabilities. If your passwords are short, predictable, reused from other sites, or haven’t been changed in years, automated brute force tools will crack them with ease.
Use a password manager to generate credentials for your WordPress admin, database, hosting account, and FTP/SFTP. Then layer on two-factor authentication. Use Two-Factor Authentication (2FA) for all admin and editor accounts — plugins like WP 2FA or Wordfence make this straightforward to configure.
5. Audit, Update, and Purge Your Plugins and Themes
This is the single highest-risk area on any WordPress site. According to Patchstack’s 2025 annual report, 97% of WordPress vulnerabilities originated in plugins and themes, not WordPress core. Every outdated plugin is a known, documented attack vector.
Before launch, run through this audit:
- Update everything. Outdated WordPress software often contains known security vulnerabilities that hackers can exploit — regularly updating core, themes, and plugins applies the latest security patches to close those holes.
- Delete what you don’t use. Delete any plugins or themes you are not using — deactivated plugins still represent an attack surface.
- Be selective about what you install. If a plugin or theme hasn’t been updated in ages or has been officially abandoned, it’s time to show it the door. Outdated or deprecated plugins aren’t just clutter — they’re potential security hazards waiting to happen.
- Enable auto-updates for minor releases. In
wp-config.php, add:define('WP_AUTO_UPDATE_CORE', true);
6. Run a Web Application Firewall (WAF)
A WAF acts as a shield at your website’s entry point, filtering out malicious traffic before it even reaches your server. There are two main types:
- DNS-level / cloud-based WAF (e.g., Cloudflare): Cloud-based firewalls sit between your site and the rest of the internet and block bad traffic before it even reaches your server.
- Plugin-based WAF (e.g., Wordfence, Sucuri): Filters traffic after it reaches your server, just before WordPress loads. Still valuable, especially combined with cloud-level protection.
Some security plugins offer basic WAF functionality, but consider dedicated WAF solutions from providers like Cloudflare for advanced protection — the basic level is free, easy to set up, and can make your site faster as well.
7. Add HTTP Security Headers
Security headers are instructions your server sends to the browser that activate protective policies. Without them, your visitors’ browsers have no guidance on how to handle cross-origin requests, clickjacking attempts, or MIME-type sniffing attacks.
Add these to your .htaccess or server configuration before launch:
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: geolocation=(), microphone=()Use a free tool like securityheaders.com to verify your configuration before going live.
8. Upgrade PHP to a Supported Version
Upgrading to the latest PHP (PHP 8.x) is essential to keep your WordPress site secure and also provides performance benefits. Always test compatibility with your themes and plugins, then update PHP through your hosting control panel. Newer PHP versions include security patches and improve site speed, which also boosts SEO.
9. Use SFTP, Not FTP
File Transfer Protocol (FTP) transmits data in plain text, making it inherently insecure. Opt for Secure File Transfer Protocol (SFTP) instead. Any reputable web host will support SFTP connections — make sure this is the only file transfer method used by you and any developers on the project.
10. Set Up Off-Site Backups and Test a Restore
Backups are your recovery plan when everything else fails. A backup stored on the same server as your WordPress installation is not a real backup — if the server is compromised, the backup goes with it.
Store backups in a separate location (a dedicated cloud storage account works well). Then, critically: test a restore before launch — a backup you’ve never restored is a backup you’ve never verified. Schedule automated daily backups post-launch so you’re never more than 24 hours behind.
11. Limit Login Attempts and Change the Login URL
Automated login attempts have nearly doubled since January 2025, largely driven by AI-enhanced botnets. Two quick wins here:
- Limit login attempts using a plugin like Limit Login Attempts Reloaded or your security plugin’s built-in brute force protection.
- Move the login URL away from the default
/wp-adminand/wp-login.phpusing a plugin like WPS Hide Login. This won’t stop a determined attacker, but it eliminates massive volumes of automated bot traffic.
12. Disable XML-RPC If You Don’t Need It
XML-RPC is a legacy remote access feature that most sites no longer need and that attackers routinely abuse for brute-force and DDoS amplification. Disable it in .htaccess:
<Files xmlrpc.php>
Order Deny,Allow
Deny from all
</Files>If you use Jetpack or the official WordPress mobile app, both now work without XML-RPC enabled.
13. Harden File Permissions
Correct file permissions prevent attackers (and buggy plugins) from writing to directories they shouldn’t touch. The baseline before launch:
wp-config.php— 400 or 440- Directories — 755
- Files — 644
.htaccess— 444
Also add the following to wp-config.php to prevent in-dashboard file editing, which is a common post-compromise persistence vector:
define('DISALLOW_FILE_EDIT', true);14. Run a Vulnerability Scan Before Going Live
Security vulnerability scanners can identify potential weaknesses in your website’s code and configuration. While not a foolproof solution, these tools can be valuable assets in your security arsenal. Free options include WPScan (command line) and the free tier of Wordfence. Run a full scan and resolve any findings before your launch date.
Security Is a Habit, Not a One-Time Task
The first 24 hours are critical when a new exploitable vulnerability is published in the ecosystem, requiring close monitoring, fast tuning, and strong response readiness. That means the work doesn’t stop at launch. Keeping an eye on your website’s traffic and usage patterns can help you spot early signs of an attack — sudden spikes in traffic from a single country or unknown source, or a surge in failed login attempts, could indicate brute-force or DDoS activity.
Schedule monthly security reviews, keep your plugin inventory lean, and subscribe to a vulnerability feed like Patchstack or WPScan so you hear about new threats before attackers exploit them on your site.
Need Help Locking Down Your WordPress Site?
This checklist covers the essentials, but implementation takes time — and mistakes during setup can leave gaps. Our team at 978host handles WordPress security hardening, managed updates, and off-site backups as part of our managed WordPress hosting plans. If you’d prefer to hand this off to someone who does it every day, contact us and we’ll walk you through what’s right for your site.