DEV Community: Bob

WordPress Security Hardening: A 10-Step Technical Checklist

Bob — Fri, 21 Aug 2026 12:24:02 +0000

WordPress powers 40%+ of the web, which also makes it the most heavily targeted CMS by automated attack tools. Most compromises aren't sophisticated — outdated core/plugin versions, weak admin credentials, or nulled plugins with backdoors baked in. Here's a hardening checklist ordered by priority.

Stay current — the cheapest security you'll ever get

Enable core auto-updates in wp-config.php:

php
define( 'WP_AUTO_UPDATE_CORE', true );

Plugin auto-updates can be toggled individually from the dashboard. If you're running custom development or version-pinned plugins, manual update control is safer — auto-updates that break something are harder to debug blind.

Kill the low-hanging brute-force targets

Don't use admin as your username — it's the first string every attack tool tries. Passwords: 16+ characters, generated (not memorized), stored in a password manager. Then layer 2FA on top — Wordfence Login Security or the Two-Factor plugin, ~10 min setup, meaningfully closes the gap even if a password leaks.

HTTPS, no exceptions

Free via Let's Encrypt, one-click on most hosts. After installing: update both WordPress Address and Site Address to https:// in settings, then (once on Cloudflare) enable Always Use HTTPS + Automatic HTTPS Rewrites to kill mixed-content warnings.

One security plugin — not multiple

Overlapping security plugins conflict and tank performance. Pick one:

Wordfence — free tier includes WAF, brute-force protection, malware scanning. Free-tier firewall rules lag 30 days behind premium.
Solid Security (formerly iThemes) — friendlier config UI, DB prefix modification, decent free Site Scanner.
Sucuri — free tier is monitoring/logging only; paid WAF is solid but pricier, better suited to higher-traffic sites.

Rate-limit login attempts

5 failures → 15-30 min IP lockout. Built into Wordfence/Solid Security, or use the lightweight Limit Login Attempts Reloaded standalone.

Move off /wp-admin and /wp-login.php

Doesn't fix root-cause security, but filters out a large volume of automated scanning traffic. WPS Hide Login handles this. Critical: write down your new path immediately, and confirm you have SSH/FTP fallback access before you change it — locking yourself out is a real failure mode here.

Backups — files AND database, both

Database-only backups can't restore themes/media. File-only backups can't restore orders/users. Tiered retention: 7 daily / 4 weekly / 3 monthly. UpdraftPlus free tier handles scheduled pushes to Drive/Dropbox/S3. Even if your host does automatic backups, keep an independent copy elsewhere — don't let both copies live on the same infrastructure.

Cloudflare in front of everything

Free tier gets you CDN, basic DDoS mitigation, DNS. After switching nameservers, enable Bot Fight Mode, Browser Integrity Check, Security Level → Medium+. Cloudflare filters at the network layer before requests hit your server; your security plugin filters at the application layer after. They're complementary, not redundant — you need both.

Delete, don't just deactivate

A deactivated plugin's files still sit on disk. If there's an unpatched vuln in those files, direct path access can still exploit it. Audit periodically: remove anything unused entirely, and flag anything not updated in 2-3 years or marked "untested" with the current WP version for replacement.

Never run nulled plugins/themes — injected backdoors are endemic in these, and they undermine every other item on this list.

WooCommerce-specific additions

Audit admin/shop-manager role assignments periodically. Keep payment plugins (Stripe, PayPal) updated with priority — vulnerabilities here carry higher blast radius. Enable email alerts for orders and admin logins. Watch for anomalous refund patterns as a signal of account compromise.

If you do get compromised: take the frontend offline immediately, restore from the last known-clean backup, rotate all credentials, then audit for unfamiliar PHP files — wp-content/uploads is the most common webshell drop location since it's usually writable and rarely audited.

Full writeup with a cost breakdown table and additional context: [https://kuajingbase.com/en/articles/1cg02jkd-wordpress-security-guide-2026-a-10-step-checklist-to]

Curious what others are running for the login-path change — anyone using firewall rules to restrict /wp-admin to specific IP ranges instead? Seems more robust than obscuring the path.

Cloudways WooCommerce Store Setup Tutorial 2026

Bob — Tue, 04 Aug 2026 07:34:40 +0000

Most people struggle with launching a store not because of WooCommerce, but because of the server layer. A bare VPS forces you to set up the full LNMP stack, request SSL certificates, and chase down configuration errors; shared hosting often leaves performance worries hanging over the site. Cloudways occupies the middle ground: it takes care of the infrastructure so you can concentrate entirely on WordPress.

This walkthrough pairs Cloudways with DigitalOcean and is aimed at a new cross-border independent store. If you already know your way around servers, skip ahead to step 5 and go straight into the WooCommerce setup.

Understanding What Cloudways Is

Cloudways is not a cloud provider in its own right—it is a managed platform that sits on top of providers such as DigitalOcean, Vultr, AWS, or Google Cloud. Once you choose the underlying infrastructure, Cloudways handles the rest: one-click deployment, SSL, automated backups, and Cloudflare integration all live inside a simple control panel.

For beginners the biggest advantage is that Linux commands, PHP, MySQL, and web-server installation disappear from the checklist. The trade-off is an extra management fee on top of the cloud provider’s base price, so the monthly bill runs a little higher than a raw VPS. In most cases the time saved on operations more than covers the difference.

At the moment the DigitalOcean 1-core / 2 GB plan lands roughly in the $14–20 range (always double-check the official site, as Cloudways has adjusted pricing in recent years). For a young store doing fewer than 20,000 visits a month this size is more than enough. Scale the resources only when product catalog or traffic starts to grow.

Step 1: Create the Server and Application

After you sign up for Cloudways, open the panel and hit Launch Server. Under Application type select WooCommerce rather than plain WordPress—the template installs both WordPress and WooCommerce automatically, so you skip the manual plugin activation step.

DigitalOcean is a practical default for most new sites: competitive pricing, wide choice of data centers, and a solid track record. If your audience sits mainly in Southeast Asia, Vultr’s regional routes are worth a look; larger or high-traffic projects may prefer AWS.

Choose the server location according to your customers: U.S. traffic → New York or Fremont; Europe → Frankfurt or London; Southeast Asia → Singapore. Proximity improves baseline response times. A CDN can mitigate distance to a degree, but it cannot replace a well-placed origin server.

Confirm the settings and click Launch Now. The server is usually ready within a few minutes.

Step 2: Bind the Domain and Configure SSL

Once the server is live, open Domain Management inside Cloudways and add your domain. At your registrar point the A record to the IP address Cloudways supplied. DNS changes typically propagate anywhere from a few minutes to a couple of hours.

After the domain resolves, go to the SSL Certificate section, pick Let’s Encrypt, enter the domain and an email address, and install. The process finishes in under two minutes and the site automatically switches to HTTPS. Skipping SSL is not only a security risk—it also hurts SEO and visitor trust.

Step 3: WooCommerce Basic Configuration

Inside the WordPress dashboard head to WooCommerce → Settings. Several items must be set correctly before the store can function properly.

Store basics: country, address, and currency. The currency you choose here determines how payment gateways will display prices later—most cross-border sellers settle on USD or the currency of their primary market.

Payment methods: enable both Stripe and PayPal. Stripe processes cards and also supports Apple Pay and Google Pay, making it the default for independent-store card payments. PayPal still carries high trust among Western shoppers and serves as a useful secondary option. Install the official WooCommerce Stripe Payment Gateway and WooCommerce PayPal Payments plugins, then complete the API-key setup through each plugin’s wizard.

Shipping: decide between flat rate, weight-based, or country-zone rates according to your model. For purely digital products simply leave shipping disabled and uncheck “needs shipping” on each product.

Step 4: Install Essential Plugins

Excessive plugins are a frequent cause of slow WooCommerce sites. On a fresh store keep the list short and expand only when necessary:

Rank Math SEO: handles SEO settings and on-page optimization. The free edition already covers Schema, sitemaps, and breadcrumbs in detail.

A caching plugin: note that LiteSpeed Cache shines only on LiteSpeed servers. Cloudways DigitalOcean and Vultr instances run Apache or Nginx by default, so LiteSpeed Cache adds little value. Prefer WP Rocket (paid, consistently effective) or W3 Total Cache (free). If you are on Cloudways’ Cloudflare Enterprise plan, pairing it with Cloudflare’s own cache is another strong option.

UpdraftPlus: an independent backup plugin. Cloudways already provides platform-level backups, yet a separate channel remains good practice—especially before plugin or theme updates.

Wordfence Security: baseline protection. The free version already blocks the majority of common attack patterns.

Step 5: Site Speed Optimization

Page speed has a direct impact on conversion rates—treat this step as mandatory.

Connect Cloudflare: Cloudways offers a one-click Cloudflare integration. Even the free plan activates CDN delivery and basic caching. Point your domain’s nameservers to Cloudflare, turn on proxy mode, and static assets will load noticeably faster.

Image format: upload everything in WebP. Files are typically 30–50 % smaller than the equivalent JPG, producing an immediate improvement in load time. Tools such as Squoosh or ShortPixel make batch conversion straightforward.

Plugin count: every active plugin adds database queries and PHP overhead. Review the list regularly, deactivate and delete anything no longer needed, and avoid turning the plugin page into an “install-and-forget” archive.

Is This Stack Right for You

Cloudways + WooCommerce works best when you intend to run a branded independent store for the long term, plan to grow traffic through Google SEO and content marketing, and want to avoid both server administration and Shopify’s platform limitations.

If you have zero interest in infrastructure and simply want to start selling quickly, Shopify remains the lower-friction route. If you already know Linux and are comfortable managing a VPS, a raw DigitalOcean or Vultr instance with a manual LNMP stack will cost less. Cloudways sits in the middle, offering a practical balance of control and convenience.

Beginning on the DigitalOcean 2 GB RAM plan is sensible. Only consider an upgrade once monthly visits consistently exceed 30,000–50,000—there is no need to over-provision on day one.

DEV's Summer Bug Smash

Bob — Tue, 04 Aug 2026 07:29:19 +0000

This is a submission for DEV's Summer Bug Smash: Smash Stories powered by Sentry.