WordPress Hardening: Advanced Security With Code

By Hridoy Ahmed | Last updated: October 2026 | 8 min read

Short answer: You can harden WordPress with a few small code changes: turn off the file editor, block PHP from running in the uploads folder, stop directory listing, protect wp-config.php and turn off XML-RPC if you do not use it. These steps reduce common attack paths, but they do not replace updates, strong passwords, backups and a firewall. Always back up and test on a staging site first.

Before you edit any code

Take a full backup of files and database.
Test on a staging copy if you can.
Keep a way to undo the change, such as FTP or your host’s file manager.

These tips are for defence only. For the basics, start with my WordPress security checklist.

Changes in wp-config.php

Add these lines above the line that says “That’s all, stop editing”:

define( 'DISALLOW_FILE_EDIT', true );
define( 'FORCE_SSL_ADMIN', true );

DISALLOW_FILE_EDIT removes the theme and plugin code editor from the dashboard, so an attacker who gets in cannot edit code there.
FORCE_SSL_ADMIN forces the login and admin area to use HTTPS. Only use it when your site already works on HTTPS.

Also make sure the file is not world-writable. Your host can tell you the correct permission.

Changes in .htaccess (Apache)

These work on Apache servers. Nginx servers need equivalent rules in the server configuration, so ask your host. Edit carefully, because a typo can take the site down.

1. Stop directory listing. In the main .htaccess add:

Options -Indexes

2. Protect wp-config.php. In the main .htaccess add:

<Files wp-config.php>
Require all denied
</Files>

3. Block PHP files in the uploads folder. Create a new .htaccess file inside wp-content/uploads/ with:

<FilesMatch "\.php$">
Require all denied
</FilesMatch>

Uploads should only hold images and documents. If a hacker uploads a PHP file there, this stops it from running. Check that your site still works after you add it.

Turn off XML-RPC

XML-RPC is an old remote access feature. If you do not use it, turn it off. Add this to a small custom plugin or a code snippet plugin, not to your theme:

add_filter( 'xmlrpc_enabled', '__return_false' );

Some apps and services use XML-RPC, such as the old WordPress mobile app or Jetpack, so check that you do not need it first.

If you would rather have an expert do this safely, see my WordPress security service.

After the changes

Open the front end and the dashboard and test key pages and forms
Check your security scan for new warnings
Use a firewall and two-factor authentication for the login

Common mistakes

Editing files without a backup
Putting code in the wrong place and causing a white screen
Turning off XML-RPC when a service needs it
Thinking code tweaks are a replacement for updates
Using random code from the internet without understanding it

FAQ

What is DISALLOW_FILE_EDIT?

It is a setting that removes the built-in theme and plugin editor from the WordPress dashboard.

Is it safe to disable XML-RPC?

Yes, if nothing on your site uses it. Check first.

Do these tweaks make my site hack-proof?

No. They reduce risk. You still need updates, strong passwords, backups and monitoring.

Does this work on Nginx?

The .htaccess rules do not. Nginx needs equivalent rules in its configuration.

Should I use a plugin instead?

A reputable plugin can apply some of these settings for you. Code gives you finer control but needs more care.

Want your site hardened without the risk? I will apply and test these changes for you. See my WordPress security and malware removal service.

About the author: Hridoy Ahmed is an SEO specialist and WordPress security expert based in Dhaka, Bangladesh. He has 8+ years of experience and works with clients worldwide.

WordPress Hardening: Advanced Security Tweaks With Code