WordPress Admin Security: How to Harden Your Philippine Website Against Hackers

WordPress powers a large share of Philippine business websites—from SMB company sites to online stores and booking platforms. That popularity makes it a target. Automated bots scan for unprotected WordPress login pages, outdated plugins, and weak passwords around the clock. The damage from a successful attack ranges from injected spam links (which hurt your search rankings) to full site takeovers and data loss. The good news: many of the most effective hardening steps can be done from your WordPress dashboard or hosting control panel, though a few, such as file permissions, depend on how your host is set up.

Why WordPress Sites in the Philippines Are Targeted

Hackers rarely target websites personally—they use automated scripts that scan large numbers of sites, looking for known vulnerabilities. A site built on an outdated WordPress version, a plugin that hasn't been updated in a year, or an admin account named "admin" with a simple password can be found and exploited quickly by these scanners.

The consequences for Philippine businesses go beyond the technical. Customers who see a security warning in their browser may lose trust in your business. Cleaning a compromised site can take considerable time, and on shared hosting, a vulnerability in your site can sometimes be used to reach neighboring accounts. If your site has already been compromised, read what to do first when your website is hacked before proceeding with hardening.

WordPress Security Hardening Checklist

Use this list as a baseline, and compare it with the official WordPress Hardening handbook.

• Change the default admin username from "admin" to something unique
• Use a strong password of at least 16 characters with mixed characters
• Enable two-factor authentication (2FA) on the admin account, and save and test its recovery method
• Install a login-attempt limiting plugin (e.g., Limit Login Attempts Reloaded)
• Keep WordPress core, all plugins, and themes updated
• Delete unused themes and plugins — even deactivated ones
• Before restricting XML-RPC, check whether Jetpack or another connected service uses it, then test after the change
• Review file permissions with your host's guidance (755 and 644 are common starting points, not universal rules), and record the current values first
• Enable SSL/HTTPS and redirect all HTTP traffic to HTTPS
• Install a WordPress security plugin for ongoing monitoring

Step-by-Step: How to Harden Your WordPress Admin

1. Secure admin credentials immediately Log in to your WordPress dashboard. If your admin username is "admin", create a new administrator account with a different username. Log in with it in a separate browser or private window, confirm it has the Administrator role and can open Users, Plugins, and Settings, and only then delete the original "admin" user (assigning its content to your new account). Set a password of at least 16 characters using a mix of uppercase, lowercase, numbers, and symbols. Use a password manager to store it — do not reuse passwords from other accounts.
2. Enable two-factor authentication (2FA) Install a 2FA plugin such as WP 2FA or Two Factor Authentication from the WordPress plugin repository. These plugins add a time-based one-time password (TOTP) requirement to the login process, so even if an attacker has your correct password, they should not be able to log in without the code from your authenticator app. Save the plugin's recovery method (for example, backup codes, if offered) somewhere safe and test it in a separate session. Enable 2FA for every administrator-level account.
3. Limit login attempts By default, WordPress allows unlimited login attempts. Install Limit Login Attempts Reloaded (free) to block IP addresses after a set number of failed attempts. Set a lockout of several minutes after a few failed attempts, adjusted so legitimate users are not locked out. This slows brute-force attempts from a single IP address, but it cannot fully stop distributed attacks that rotate across many IP addresses, so use it with strong passwords and 2FA.
4. Keep everything updated — on a schedule Outdated plugins and themes with known vulnerabilities are a common way sites get compromised. Follow WordPress's official upgrading guide and establish a weekly update habit. Before updating, take a full site backup. Enable automatic background updates for WordPress minor/security releases at minimum: add define( 'WP_AUTO_UPDATE_CORE', 'minor' ); to your wp-config.php if your host doesn't do this automatically.
5. Restrict XML-RPC only if nothing needs it XML-RPC is a WordPress feature used for remote publishing and by some connected services, and it can also be abused for brute-force login attempts. Jetpack depends on it, and blocking xmlrpc.php can break Jetpack's connection (see Jetpack's known issues). Before changing anything, check whether Jetpack or any other remote-publishing app is in use. If not, disable XML-RPC through a security plugin or your .htaccess file (keep a copy of the original), then test the features you rely on.
6. Check and correct file permissions Log in to your hosting control panel (cPanel) and open the File Manager, or connect using SFTP or your host's encrypted file-transfer option instead of plain FTP. Before changing anything, record the current permissions. The WordPress Hardening handbook gives 755 for directories and 644 for files as one possible scheme, not a universal rule. The right values depend on file ownership, the user PHP runs as, and your host's recommendations, so do not apply one value to everything, and never use 777. Ask your host what it recommends for wp-config.php; a stricter value is only safe if PHP can still read the file. After any change, load the site, log in, and test a media upload and a plugin update.
7. Install a WordPress security plugin A security plugin adds ongoing monitoring, but plugins differ, so compare current features first. According to its official page, Wordfence Free includes a firewall and malware scanner (new rules and signatures arrive after a 30-day delay, and there is no IP blocklist), plus two-factor authentication, rate limiting, and brute-force protection. The WordPress.org listing for Kadence Security (formerly iThemes Security and Solid Security) lists two-factor authentication, brute-force protection, file change detection, and a vulnerability-focused site scanner in its free version; its site scan checks Google's blocklist status for malware warnings. Run the setup wizard and enable the recommended settings.

Common Security Mistakes Philippine WordPress Site Owners Make

Frequently Asked Questions