What is a practical WordPress security hardening checklist for a live site?

Most compromises come from outdated plugins, weak credentials and writable code. Work through these.

Updates

• Keep core, plugins and themes updated; delete anything unused (deactivated is not safe).
• Avoid nulled or pirated themes and plugins, which usually carry backdoors.
• Run a supported PHP version (8.3 or newer at this time).

Accounts

• Unique strong passwords, 2FA for admins, no user named admin, least privilege roles.
• Limit login attempts (rate limiting at the firewall or a plugin).

Configuration in wp-config.php:

define( 'DISALLOW_FILE_EDIT', true );   // removes the theme/plugin code editor
define( 'FORCE_SSL_ADMIN', true );
define( 'WP_DEBUG_DISPLAY', false );

Generate fresh salts at the official salt service and replace the keys; this logs everyone out.

Files

• Directories 755, files 644, wp-config.php 600 or 640.
• Move wp-config.php above the web root if your host allows.
• Block PHP execution in uploads (Nginx):

location ~* /wp-content/uploads/.*\.php$ { deny all; }

• Deny access to xmlrpc.php if you do not use it, and to .git, .env, *.sql, debug.log.

Network

• HTTPS everywhere with HSTS, a WAF or CDN in front, and security headers (see the CSP and security headers generator).

Operations

• Offsite backups tested by restoring, file integrity checks (wp core verify-checksums, wp plugin verify-checksums --all), and log monitoring.

If already compromised: restore a clean backup, rotate all passwords, salts, database and API credentials, then patch the entry point or it returns.