How to Secure Your WordPress Admin Panel From Hackers

Using WPS Hide Login (Recommended)

1. Install and activate WPS Hide Login (200K+ installs, free)
2. Go to Settings → WPS Hide Login
3. Change the login URL to something unique (e.g., /my-secret-login)
4. Set the redirection URL (where /wp-admin redirects to; use a 404 page)
5. Bookmark your new login URL: you won't be able to access the old one

Password Policy Best Practices

• Use a password manager (1Password, Bitwarden), generate unique 20+ char passwords for every account
• Require all admin/editor users to use password managers (enforce via policy)
• Never share passwords via email, Slack, or text; use the password manager's sharing feature
• Check passwords against breach databases (Have I Been Pwned), compromised passwords are tried first
• WordPress generates strong passwords by default, don't let users override with weak ones

Principle of Least Privilege

• Give each user the minimum role needed for their job, never make everyone an Administrator
• Audit user accounts quarterly; remove inactive accounts and downgrade unnecessary admin access
• Use the User Role Editor plugin to create custom roles if default WordPress roles don't fit
• Require 2FA for all Administrator and Editor accounts (enforced, not optional)
• Set an auto-logout timeout (15-30 minutes) for admin sessions

Fix Permissions via SSH

# Set directory permissions to 755
find /path/to/wordpress/ -type d -exec chmod 755 {} \;

# Set file permissions to 644
find /path/to/wordpress/ -type f -exec chmod 644 {} \;

# Lock down wp-config.php
chmod 600 /path/to/wordpress/wp-config.php

# Lock down .htaccess
chmod 644 /path/to/wordpress/.htaccess

// Disable file editing from wp-admin (prevents code injection via admin panel)
define('DISALLOW_FILE_EDIT', true);

// Disable plugin/theme installation from admin (require SFTP)
define('DISALLOW_FILE_MODS', true);

// Force SSL for admin panel
define('FORCE_SSL_ADMIN', true);

// Limit post revisions (reduces database bloat)
define('WP_POST_REVISIONS', 5);

// Set auto-save interval (seconds)
define('AUTOSAVE_INTERVAL', 300);

// Disable WordPress debug mode in production
define('WP_DEBUG', false);
define('WP_DEBUG_LOG', false);
define('WP_DEBUG_DISPLAY', false);

// Block external HTTP requests (whitelist specific hosts if needed)
// define('WP_HTTP_BLOCK_EXTERNAL', true);
// define('WP_ACCESSIBLE_HOSTS', 'api.wordpress.org,downloads.wordpress.org');

// Move wp-content directory (optional, advanced)
// define('WP_CONTENT_DIR', dirname(__FILE__) . '/app');
// define('WP_CONTENT_URL', 'https://example.com/app');