How do I protect WordPress against the most common attack vectors?

WordPress powers 43% of all websites and is the most-targeted CMS. Common attack vectors are brute-force logins, vulnerable plugins, SQL injection through plugins, XML-RPC abuse, and file upload exploits. A five-layer defense (hosting security, WordPress hardening, plugin management, monitoring, backups) makes WordPress dramatically harder to compromise.

DETAILED EXPLANATION:
WordPress attack statistics:
- 90% of hacked WordPress sites were attacked via vulnerable plugins/themes
- Brute-force attacks: Automated bots attempt millions of password combinations
- XML-RPC exploitation: Old API endpoint enables brute-force and DDoS
- PHP file upload: Malicious PHP files uploaded through vulnerable plugins
- SQL injection: Plugin sanitization failures allow database manipulation

Five-layer WordPress defense:

Layer 1 - Hosting security (Connect Quest provides):
- Imunify360 WAF: Blocks known exploit signatures before reaching WordPress
- CageFS: PHP scripts cannot access other users' files
- ModSecurity: HTTP layer attack filtering
- Network-level DDoS protection

Layer 2 - WordPress core hardening:
- WordPress core auto-updates enabled
- wp-config.php security keys randomized
- Database prefix changed from wp_ to custom
- File editing disabled in WordPress admin

Layer 3 - Login protection:
- Strong password enforced (20+ chars, random)
- Username NOT "admin" (attackers target this specifically)
- Two-factor authentication (Wordfence or WP 2FA plugin)
- Login URL changed from /wp-login.php
- Rate limiting on login attempts

Layer 4 - Plugin/theme hygiene:
- Only install plugins with 100,000+ active installs and recent updates
- Delete inactive plugins and themes (they are still attack surface even deactivated)
- Update plugins immediately on new releases
- Avoid nulled/pirated themes (100% contain malware)

Layer 5 - Monitoring and backup:
- Daily file integrity scanning (Wordfence or Sucuri)
- Real-time alerting on login failures, file changes
- Daily automated backups to offsite storage (restic to Backblaze B2)
- Backup tested monthly

STEP-BY-STEP - Complete WordPress hardening:

1. Install security plugins:
Wordfence Security (free tier excellent):
WordPress Admin > Plugins > Add New > Wordfence > Install > Activate
Configure:
- Enable Firewall (Web Application Firewall)
- Enable Brute Force Protection: max 5 failed logins -> 20-minute lockout
- Block Countries: If no legitimate users from specific countries
- Enable Two-Factor Authentication for admin users

2. Disable XML-RPC (most sites do not need it):
Add to .htaccess:
# Block XML-RPC
<Files xmlrpc.php>
Order Allow,Deny
Deny from all
</Files>

Or Nginx config:
location = /xmlrpc.php {
deny all;
}

3. Secure wp-config.php:
Add to wp-config.php:
define('DISALLOW_FILE_EDIT', true); // No theme/plugin editing from admin
define('DISALLOW_FILE_MODS', true); // No plugin installs from admin
define('FORCE_SSL_ADMIN', true); // Admin always HTTPS
define('WP_AUTO_UPDATE_CORE', true); // Auto-update WordPress core

# Change table prefix (do this at installation time):
$table_prefix = 'xyz48_'; // Not wp_

4. Protect wp-config.php and sensitive files:
Add to .htaccess:
<Files wp-config.php>
Order Allow,Deny
Deny from all
</Files>

<Files .htaccess>
Order Allow,Deny
Deny from all
</Files>

5. Limit login URL (change /wp-admin to custom URL):
Install WPS Hide Login plugin
Change login URL to: /portal-in-2025 (or any secret URL)
Anyone visiting /wp-admin gets 404 instead of login form

6. Database user least privilege:
Current: WordPress user often has GRANT ALL (dangerous)
Fix in MySQL:
REVOKE ALL ON wordpress.* FROM 'wpuser'@'localhost';
GRANT SELECT, INSERT, UPDATE, DELETE ON wordpress.* TO 'wpuser'@'localhost';
-- Remove CREATE, DROP, ALTER (WordPress needs these only during install/updates)

REAL EXAMPLES:
Attack blocked by Wordfence (daily log excerpt):
April 1, 03:42: Blocked 1,247 brute force attempts from 89.0.142.5 (RU)
April 1, 07:15: Blocked SQL injection attempt in plugin contact form
April 1, 11:30: File change detected in /wp-content/plugins/old-plugin/ -> ALERT

Before hardening: 3,000 blocked attacks/day consuming server resources.
After blocking XML-RPC and changing login URL: 200 blocked attacks/day (93% reduction).

WordPress malware cleanup statistics (Sucuri):
60% of infected sites: Unauthorized admin user created
25%: PHP backdoor in uploads directory
15%: Core file modification

FLOW:
Attacker identifies WordPress site -> Tries /wp-login.php (BLOCKED: changed URL)
-> Tries XML-RPC (BLOCKED: disabled)
-> Tries plugin vulnerabilities -> Wordfence WAF blocks known signatures
-> Imunify360 detects anomalous behavior, blocks IP
-> Daily backup ready if anything does get through

KEY POINTS:
- Auto-updates for WordPress core and plugins are the single most impactful security measure
- Nulled/pirated plugins/themes contain malware in 90%+ of cases - never use
- Connect Quest Imunify360 on all hosting plans adds server-level protection beyond Wordfence
- Wordfence free tier is sufficient for most sites; paid adds real-time IP reputation

COMMON MISTAKES:
- Username "admin" with weak password (most common WordPress compromise)
- 80+ plugins installed (large attack surface, update burden)
- Not deleting inactive plugins (still exploitable even when deactivated)
- No backup strategy (malware cleanup useless without clean restore point)

QUICK FIX:
WordPress hacked: Restore from last known-good backup immediately (do not try to clean manually).
Then: Update all plugins, change all passwords, check for unauthorized admin users.
Contact Connect Quest +91 2269711150 for malware removal assistance.

DIFFICULTY: Intermediate
RELATED: WordPress Hosting, Imunify360, cPanel Security, Backup Strategy