WordPress Security Without Plugins: 6 Best Tips

Do you rely on a security plugin to protect your WordPress site? Are you confident about what most of the features in these plugins actually do?

Personally, I’m not a big fan of using security plugins. Instead, I’ve spent time learning and implementing effective strategies to safeguard my WordPress sites without relying on them.

Here are my top recommendations to keep your WordPress site secure.

---

---

Create a Strong Username and Password for your Site

The first step is using a password manager, so you can create and use long and complex passwords.

I use Bitwarden to save all my passwords but feel free to use the one you like the most.

Password Managers have options to create complex passwords.

You can create a complex username and password for your WordPress site.

#1	ZKA4UkfoAESmcUUuCcv3@g%Tm%Dk
#2	dw6PL3Wxt@i2cvnC$vhYNo997@GSNU

That would make your username and password super hard for hackers and bots to crack using brute force attacks.

According to Bitwarden’s Password Strength Testing Tool, the username and passwords shown above will take centuries to crack.

If a brute force attack works on your site is because you are way too ignorant or dumb to manage a website.

Obviously you don’t want bots trying millions of usernames and passwords on your login page because that will bring your server down.

---

Block XML-RPC Access

The XML-RPC protocol allows multiple login attempts in a single request, so this means attackers can submit numerous login attempts in one go, bypassing standard rate-limiting measures that protect the login page.

If your site doesn’t use XML-RPC, consider disabling it altogether. This can be done using a PHP snippet.

add_filter('xmlrpc_enabled', '__return_false');

You can create a mu-plugin and forget about attacks made to the XML-RPC once and for all.

<?php
/**
 * Plugin Name: Disable XML-RPC
 * Description: Disables XML-RPC functionality in WordPress.
 * Author: TicoLibre
 * Version: 1.0
 */
// Disable XML-RPC
add_filter('xmlrpc_enabled', '__return_false');

Using a mu-plugin to block access to the XML-RPC is technically speaking a security but not one that requires updates, upgrades to do its job well.

---

WordPress Core, Plugins and Themes

There are several things that you can do to make your site doesn’t get hacked via your theme and plugins

1. Install and Keep the plugins that you really need.
2. Get rid of plugins that you don’t really need.
3. Update all plugins as soon as there is an update or wait a few days only if you are completely sure that these don’t have an active vulnerability.
4. Keep your version of WordPress updated.
5. Download plugins and themes directly from the developers and WordPress.org
6. Don’t install nulled garbage.
7. Avoid the practice of installing a plugin for every tiny thing you want to add or remove from WordPress.
8. Use mu-plugins instead of using plugins.

Try to follow WordPress Security blogs and subscribe to their mailing lists to get news about the themes and plugins with active vulnerabilities.

---

Make Site Backups Regularly

Make sure that you use a hosting provider or Cloud Hosting panel that backs up your site regularly.

Cloudways does this for me. You can retain those backups for four weeks.

The frequency of the backups could be set to a minimum of one hour.

Besides that, I recommend:

• Using All in One WP Migration to make backups that you can save in a Dropbox or Google Drive account.
• Making copies of the database more regularly.

You need to be ready to restore your site in case something bad happens to one of your sites.

Cleaning a site can be expensive and restoring can save you lots of time and money.

Don’t save backups in your WordPress installation. Those could be downloaded and used to access your database and hack your WordPress site.

---

Protect your Database, FTP and SSH Access

There are many hosting providers and cloud hosting panels that will do something to prevent your WordPress sites get hacked.

The Cloudways panel has the option to protect your Database, SFTP, and SSH.

If I don’t add your IP address, you won’t be able to access my database, check my WordPress Installation or access my server and run remote commands.

---

Create a Firewall

The last thing that you can do to ensure that your site is super safe is to create Cloudflare Firewall Rules.

You can create up to five rules to help you deal with most types of threats.

I am a bit more proactive with WordPress security but this will be enough to make sure that nobody can check for PHP files on your WordPress site.

Whitelist your IP address and your server IP address to make sure you don’t get blocked by the rules you create.

---

These Features aren’t Needed

These are some features that user keeps recommending and that you don’t need when you follow some of the previous recommendations.

• You don’t need to activate two-factor authentication when no bot or person has access to your site’s login page.

• You don’t need to have other forms of login protection when no bot or person has access to your site’s login page.

• You don’t need a custom complex Firewall managed by security experts when you have all you need to build a custom one for free.

---

Conclusion

I recommend using security plugins when users don’t know sh*t about how basic WordPress security works or if users are too busy to learn about how to keep most threats at bay.