Secure your WordPress site Print

Securing your WordPress site proactively is much easier than recovering from a breach. By leveraging cPanel, WP Toolkit, Imunify360, and JetBackup, you can build a multi-layered defence to keep attackers, brute-force bots, and malicious scripts out.

Step 1: Apply One-Click Hardening with WP Toolkit

WP Toolkit includes built-in security measures that lock down common WordPress vulnerabilities without requiring you to manually write server rules.

1. Log in to cPanel and click on WP Toolkit (located under Applications or Domains).
   
   
   

2. Under your domain dashboard, click Security (or Check Security).

3. Apply the key security measures by toggling or selecting them:

   • Restrict access to files and directories: Locks file permissions (644 for files, 755 for directories) and restricts wp-config.php.

   • Disable file editing in dashboard: Prevents users (or compromised admin accounts) from modifying theme or plugin .php files inside wp-admin.

   • Block directory browsing: Stops attackers from listing your uploads folders to discover plugins or sensitive files.

   • Block execution of PHP in uploads/cache: Stops executed webshells even if an attacker manages to upload a malicious .php file.

   • Configure Security Keys (Salts): Generates secret salt keys in wp-config.php to scramble login session cookies.

Step 2: Configure Proactive Scanning & WAF in Imunify360

While WP Toolkit hardens configuration, Imunify360 acts as your server-level Web Application Firewall (WAF) and real-time antivirus.

1. On the cPanel home page, scroll to Security and open Imunify360.
   
   

2. Ensure Proactive Defense is enabled.

3. Under the Settings / Malware Scanner tab, ensure Background Scanning and Real-Time File Scanning are toggled ON.

4. Check the Proactive Defense logs periodically to see if any suspicious requests are hitting your site.

Step 3: Automate Updates & Vulnerability Patching

Outdated plugins and themes account for over 90% of WordPress entry points. Automated updates ensure security patches are applied as soon as they are released.

1. In WP Toolkit, locate your site card.

2. Click Autoupdate settings:

   • WordPress Core: Set to automatically install both minor (security) and major updates.

   • Plugins & Themes: Toggle Auto-update to ON.

3. Enable Smart Update. This creates a temporary shadow clone of your site, applies updates to the clone, checks for visual/functional glitches, and only updates your live site if everything passes safely.

Step 4: Secure User Access & Login Gateways

Standard brute-force attacks target the default login page (/wp-login.php) and standard administrator usernames.

• Change Default Admin Usernames: In WP Toolkit, run the measure to Change default administrator's name if you still have a user called admin.

• Enforce Strong Passwords: Force complex passwords for all registered accounts.

• Enable Two-Factor Authentication (2FA): Install a lightweight security plugin (such as Two-Factor or Wordfence) to require a 2FA code from an authenticator app at login.

• Change the Login URL: Move your login page away from [example.com/wp-login.php](https://example.com/wp-login.php) to a custom path (e.g., [example.com/portal-login](https://example.com/portal-login)) using a plugin.

Step 5: Verify Automated Backups via JetBackup

A secure site always has a working, off-site recovery plan. Verify that JetBackup is capturing a clean state daily.

1. Open JetBackup from the Files section in cPanel.
   
   

2. Click File Backups and Database Backups.

3. Verify that new daily backup points are generated automatically across the last 7 days.

4. Run a quick test restore on a staging domain or local file download once every few months to ensure your database dumps are non-corrupt.

Security Checklist Summary

Area	Best Practice	Tool Used
Permissions	Restrict to 644 (files) & 755 (dirs)	WP Toolkit
PHP Safety	Block PHP execution in /uploads/	WP Toolkit
Realtime WAF	Active script killing & scanning	Imunify360
Patching	Auto-update Core, Plugins & Themes	WP Toolkit
Authentication	Enforce 2FA & eliminate admin username	WP Toolkit / Plugin
Disaster Recovery	Daily 7-day snapshot verification	JetBackup