Securing a WordPress Installation on Ubuntu

WordPress's popularity makes it a prime target for attackers. A default installation is not secure enough for a production environment. This guide covers the essential steps to harden your WordPress site on a LAMP stack.

1. Prerequisites

A working WordPress installation.
- Reference: Installing WordPress on a LAMP Stack

2. File & Folder Permissions

The principle of "least privilege" is your most powerful defense. Files and folders should only have the permissions they absolutely need to function.

Reference: Mastering Ubuntu File Permissions

Set Ownership: Ensure all files are owned by the web server user (www-data).
```
sudo chown -R www-data:www-data /var/www/html
```
Set Permissions:
- Set all directories to 755 (or 750 for more security). This allows the owner to do anything, and others to read and execute (enter the directory).
- Set all files to 644 (or 640). This allows the owner to read/write, and others to only read.
```
sudo find /var/www/html/ -type d -exec chmod 755 {} \;
sudo find /var/www/html/ -type f -exec chmod 644 {} \;
```
Protect wp-config.php: This file is the most critical. It contains your database credentials. Lock it down further.
```
sudo chmod 600 /var/www/html/wp-config.php
```

3. Disable the Dashboard File Editor

By default, WordPress allows administrators to edit theme and plugin files directly from the dashboard. If an attacker gains access to your admin account, they can execute malicious code.

Edit your config file:
```
sudo nano /var/www/html/wp-config.php
```
Add this line just before /* That's all, stop editing! */:
```
define('DISALLOW_FILE_EDIT', true);
```
Save and exit (Ctrl+O, Enter, Ctrl+X). The "Theme File Editor" and "Plugin File Editor" options will now be gone from your dashboard.

4. Disable XML-RPC

XML-RPC is an old API that allows remote connections to WordPress. It's a common target for brute-force attacks. If you don't use the WordPress mobile app or other remote publishing tools, you should disable it.

Method 1 (Plugin): The easiest way is to use a security plugin (see below) which often has a one-click option to disable it.
Method 2 (.htaccess): If you are using Apache, you can block access by adding the following to your .htaccess file:
```
<Files xmlrpc.php>
order deny,allow
deny from all
</Files>
```

5. Install a Security Plugin (WAF)

A Web Application Firewall (WAF) is a shield that sits between your site and the internet, blocking malicious requests before they even reach WordPress.

Recommendation: Install Wordfence or Sucuri Security from the WordPress plugin repository.
Key Features:
- Firewall to block common attacks.
- Malware scanner to check for infected files.
- Login protection (rate limiting, 2FA).

6. General Best Practices

Don't use "admin" as a username. If you created it during installation, make a new administrator user and delete the original 'admin'.
Use strong, unique passwords for all accounts, especially your database and admin user.
Keep everything updated: WordPress core, all plugins, and all themes must be kept on their latest versions to patch security vulnerabilities.
Regular Backups: Set up a regular, automated backup schedule. A good backup is the ultimate security tool, as it allows you to recover from any disaster.

Created: March 17, 2026 • Last Modified: February 24, 2026

Docs Login