How to Fix WordPress Security Vulnerabilities

The Problem

How to Fix

1. 1

   Update WordPress core, plugins, and themes

   Run updates from the command line with WP-CLI:

   wp core update
   wp plugin update --all
   wp theme update --all

   Enable automatic security updates in wp-config.php:

   define('WP_AUTO_UPDATE_CORE', 'minor');

   Remove unused plugins and themes entirely (deactivating is not enough):

   wp plugin delete unused-plugin
   wp theme delete unused-theme

   Outdated plugins are the number one cause of WordPress compromises.

2. 2

   Secure wp-login.php and wp-admin

   Restrict access to the admin area by IP or add HTTP authentication. In Nginx:

   location /wp-login.php {
       allow 1.2.3.4;  # Your office IP
       deny all;

   fastcgi_pass unix:/run/php/php-fpm.sock;
       include fastcgi_params;
   }

   location /wp-admin/ {
       allow 1.2.3.4;
       deny all;
   }

   Alternatively, use a security plugin like Wordfence or limit login attempts:

   define('WP_LIMIT_LOGIN_ATTEMPTS', true);

3. 3

   Disable XML-RPC if not needed

   XML-RPC is used for brute-force amplification attacks. Disable it if you do not use remote publishing:

   In .htaccess:

   <Files xmlrpc.php>
       Order Allow,Deny
       Deny from all
   </Files>

   In Nginx:

   location = /xmlrpc.php { deny all; return 404; }

   Or with a WordPress filter in functions.php:

   add_filter('xmlrpc_enabled', '__return_false');

4. 4

   Isolate WordPress from your Laravel application

   If running both on the same server, isolate them:

   1. Use separate database users with different credentials 2. Run WordPress under a different system user (PHP-FPM pool) 3. Ensure WordPress cannot read Laravel files and vice versa 4. Use separate subdomains (blog.yourdomain.com vs app.yourdomain.com)

   In PHP-FPM, create separate pools:

   [wordpress]
   user = wp_user
   group = wp_user
   listen = /run/php/php-fpm-wp.sock

   [laravel]
   user = laravel_user
   group = laravel_user
   listen = /run/php/php-fpm-laravel.sock

How to Verify

wp core verify-checksums
wp plugin list --status=inactive

curl -X POST https://yourdomain.com/xmlrpc.php

wp plugin list --update=available

Prevention

Frequently Asked Questions