Seven checks to harden WordPress on shared cPanel hosting

WordPress powers a large share of the sites on any shared server, and it is where most compromises start. These seven checks close the doors attackers use most.

The checklist

• Update core, plugins and themes automatically, with a snapshot to roll back to.
• Delete plugins and themes you do not use. Deactivated is not safe.
• Keep directories at 755 and files at 644, and wp-config.php at 640 or stricter.
• Disable XML-RPC when the site does not need it.
• Run ModSecurity with a maintained ruleset.
• Give each account its own PHP-FPM pool so one site cannot read another.
• Require two-factor authentication for administrators.

Fix permissions in one pass

$ find public_html -type d -exec chmod 755 {} \;
$ find public_html -type f -exec chmod 644 {} \;
$ chmod 640 public_html/wp-config.php

Run it per account, never from the filesystem root, and test the site afterwards.