Overview

A default WordPress install is functional but not hardened. Attackers constantly scan for weak admin passwords, outdated plugins and exposed configuration files. This article lists practical steps to secure a WordPress site on an ALYPOD Pod, from locking down the admin area to enabling HTTPS and backups.

Before you begin

• A working WordPress installation.
• SSH/SFTP access and the ability to edit files.
• A backup or snapshot before making changes.

Steps

1. Keep everything updated. Apply core, theme and plugin updates promptly, and remove plugins/themes you do not use:

bash wp core update --allow-root wp plugin update --all --allow-root

1. Use strong credentials. Set a long admin password and a unique username (never admin). Change the default wp_ table prefix on new installs.

2. Force HTTPS and secure logins. Set the site URLs to https:// and add HTTPS redirects in your web server or via wp-config.php:

php define('FORCE_SSL_ADMIN', true);

1. Limit admin access by IP in your web server config. Example for Apache:

apache <Files wp-login.php> Require ip 203.0.113.10 </Files>

1. Disable file editing in the dashboard:

php define('DISALLOW_FILE_EDIT', true);

1. Block XML-RPC if you do not use it (it is a common brute-force target):

apache <Files xmlrpc.php> Require all denied </Files>

1. Add a security plugin for login throttling, two-factor authentication and file integrity monitoring, and keep a Web Application Firewall in front of the site.

2. Protect configuration and directories: ensure wp-config.php is not web-readable, and deny directory listing. Verify permissions: files 644, directories 755.

3. Back up regularly to a Storage Box or S3 bucket so you can recover from a compromise.

Troubleshooting

• Problem: Locked out after an IP restriction. Solution: Use the ALYPOD web console or SFTP to edit the config and re-allow your IP.
• Problem: Updates fail with "could not create directory". Solution: Fix ownership so the web server user owns wp-content.
• Problem: Site redirected in a loop after forcing HTTPS. Solution: Make sure the server (or a proxy) terminates TLS correctly and forwards X-Forwarded-Proto.

Related articles

• [Installing WordPress]
• [Setting up a free Let's Encrypt SSL certificate]
• [Backup best practices (the 3-2-1 rule)]