Recommended Free Tools
You can harden a WordPress site without switching off plugins that visitors and staff rely on. The safe approach is layered: create and test a complete recovery point, keep WordPress and maintained extensions current, protect administrator accounts with strong credentials and two-step authentication, remove only unused or untrusted code, and understand which firewall and infrastructure controls your host already provides.
Security lowers the likelihood and impact of compromise; it cannot promise a perfectly secure system. WordPress Developer Resources puts it plainly: “Security is not about perfectly secure systems.” The practical objective is to reduce entry points, limit damage if an attack succeeds, and recover quickly while preserving the functions your site needs.
As an Amazon Associate I earn from qualifying purchases.
Start with the right security goal
WordPress powers more than 43% of the web, according to WordPress.org. That is a statement about the platform’s reach, not a statistic about the odds that your particular site will be attacked. A site’s exposure depends on its hosting, software versions, accounts, data, configuration and visibility.
Hardening therefore means managing risk in layers rather than looking for one “secure” switch. Your essential booking, commerce, membership, form, analytics or editorial plugins can remain active when they are obtained from trusted sources, maintained, compatible with your version of WordPress and covered by a tested rollback plan.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Prevent: reduce known vulnerabilities and unnecessary entry points.
- Resist: make administrator accounts difficult to take over.
- Contain: limit what a compromised account or extension can change.
- Recover: restore a known-good site without guessing which files or database records were lost.
Do not treat a security plugin as a replacement for updates, backups, account protection or host controls. It is one possible layer, not the security strategy by itself.
1. Create a recovery point before changing anything
Make a current backup before updating plugins, changing access settings, editing configuration or altering permissions. WordPress’s plugin documentation warns that updates can cause problems, even when the update itself is legitimate. A rollback is only useful if the backup contains the whole site and can actually be restored.
What a complete backup contains
- Database: posts, pages, users, settings, orders, form entries and plugin data stored in MySQL or MariaDB.
- Files: WordPress core files,
wp-content, uploads, themes, plugins and any custom configuration or server-side files required by your installation. - Recovery information: the WordPress version, PHP and database versions, domain and DNS details, hosting access, administrator contacts and any keys or credentials needed to restore services.
Do not assume that a hosting snapshot, a database export or an automated “backup succeeded” message covers all three categories. Check what the job includes and where it is stored. The official guidance does not prescribe one universal schedule or storage device; choose a frequency that matches how often your content and transactions change.
Prove that restoration works
- Keep the new backup separate from the live site so a compromised server cannot silently overwrite every copy.
- Record the backup time, included components and the procedure for obtaining the files and database.
- Restore a copy in a staging environment or other isolated location when your host supports it.
- Check that the home page, administrator login, media, forms, search, checkout or membership flows and scheduled tasks work after restoration.
- Document any manual steps, such as changing the site URL, regenerating caches or reconnecting external services.
If you cannot restore the site in an isolated environment, treat the backup as unproven and fix that gap before making high-risk security changes.
2. Keep WordPress, plugins and themes current
Update WordPress core, active plugins and active themes from trusted sources. WordPress’s support policy identifies the latest major release as the only officially supported version. Older branches may receive security fixes as a courtesy, but backports are not guaranteed and there is no fixed support period. Running an old branch because a plugin has not been tested against a newer release leaves you carrying an increasing compatibility and security risk.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
A safe update sequence
- Check the recovery point. Confirm that a recent, restorable backup exists.
- Review the change. Read the plugin or theme update notes, its tested WordPress version indicator and any known incompatibility warnings.
- Update in a controlled window. For a busy site, use staging first or schedule a period when you can monitor errors.
- Update core and extensions deliberately. Do not click every available update without noting what changed. Keeping a short change log makes a later rollback easier.
- Test essential paths. Sign in, publish or edit content, submit forms, complete a representative transaction and check front-end pages that depend on the updated extension.
- Watch logs and visitors’ reports. A fatal error, blank page, broken styling or failed webhook may appear only after normal traffic exercises the changed code.
Automatic updates can reduce the time a known vulnerability remains exposed, but they do not remove the need for backups and post-update checks. Decide which updates your site can safely automate and which require staging or a maintenance window.
When an essential plugin looks abandoned
Do not disable a plugin reflexively if the site depends on it. First establish what it does, which pages and processes call it, when it was last maintained, whether its author publishes compatibility information and whether a supported replacement exists. If it is incompatible with the current WordPress release or has no credible maintenance path, plan a migration with a staging copy and a rollback point. Seek qualified help when the plugin stores business-critical data or controls authentication, payments or access to private content.
Free tools Windows power users keep installed
One-click scans. No signup required.
3. Decide which plugins are safe to keep
The goal is not “zero plugins.” The goal is a small, understandable set of trusted components that the site genuinely needs.
Classify every extension
| Category | Action | Reason |
|---|---|---|
| Essential and maintained | Keep active; update after a current backup and test the dependent feature. | Its function is required, and maintenance reduces known risk. |
| Useful but not always needed | Decide whether it can be replaced, scheduled or removed after verifying dependencies. | Every additional component adds code and an update obligation. |
| Unused | Deactivate, confirm nothing breaks, then delete it and remove its stored data when the plugin documents how. | Inactive code can still become a vulnerability if it remains installed and reachable. |
| Untrusted or abandoned | Replace it through a planned migration; do not keep it merely because it is familiar. | Unknown provenance and absent maintenance make vulnerabilities harder to assess or fix. |
Obtain plugins and themes from WordPress.org or known, trusted vendors. Be cautious with extensions that request broad file-write access, upload arbitrary code or expose code-execution features. WordPress warns that such capabilities can increase the impact of a compromise. Ask whether the requested access is necessary for the feature and whether it can be limited.
Map dependencies before deactivation
- Open the plugin’s settings and identify shortcodes, blocks, widgets, roles, scheduled jobs, REST integrations or templates it supplies.
- Search your pages and theme files for those components.
- Check whether another plugin imports its data or expects its hooks.
- Test the affected workflows on staging or during a controlled maintenance window.
- Keep the backup and a written reversal step until the site has operated normally.
A plugin that is inactive but still installed is not the same as a plugin that has been removed. Delete only after you understand whether its files, database tables or uploaded assets are still required.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
4. Protect administrator accounts
Administrator credentials are a high-value target because they can install code, change users and alter site settings. Use a long, unique password for every administrator account and store it in a reputable password manager rather than reusing a password from email, hosting or another site.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Enable two-step authentication
WordPress’s hardening advice recommends two-factor authentication in addition to a strong password. The second step should remain available when a phone is lost, a staff member is absent or an authenticator is replaced.
| Method | What to verify | Operational precaution |
|---|---|---|
| Time-based one-time password | The installed 2FA plugin or identity provider supports TOTP and clock drift handling. | Store backup codes offline and test account recovery before enforcing it for every administrator. |
| Security key | The specific self-hosted WordPress 2FA plugin or identity provider supports FIDO2 or the key standard it uses. | Register a second key or another recovery method; a key documented for a WordPress.org account is not proof of universal self-hosted support. |
| Recovery codes | The system generates one-time codes and clearly shows when each code is consumed. | Keep them in a protected location separate from the device used for sign-in. |
WordPress.org’s account documentation describes security keys, TOTP and backup codes for that account service. For a self-hosted installation, confirm support in your own 2FA plugin or identity provider before buying or enforcing a hardware key. Test the complete sign-in and recovery flow with a non-primary administrator first.
Reduce the number of privileged accounts
- Give people the lowest role that lets them do their work.
- Use named accounts instead of a shared administrator login so actions can be attributed and access revoked individually.
- Remove former staff and contractors promptly.
- Review administrator and editor lists periodically, including accounts created by plugins.
- Protect the email account used for password resets with its own unique password and two-step authentication.
Do not lock yourself out while hardening. Keep a tested recovery administrator and documented recovery codes, and verify that your host can help you regain access without bypassing your site’s controls.
5. Limit what a compromise can change
Containment controls matter because prevention can fail. WordPress’s hardening guidance discusses restricting Dashboard file editing and carefully managing file and database privileges.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Dashboard file editing
Built-in theme and plugin editors let an administrator write executable PHP from the Dashboard. Disabling that editing path can prevent a stolen administrator session from immediately modifying code, but it does not replace account protection or a clean recovery plan. Make the change only after confirming that your team has another documented deployment method, such as version-controlled releases or host-managed file access.
File and database privileges
Grant processes only the access they need, and avoid making every file writable by the web server. Apply restrictive database privileges carefully: WordPress updates and some plugins may need to change database structure, and an over-restricted account can make legitimate updates fail. Test privilege changes on staging, record the previous settings and keep a rollback path.
Advanced permission changes are easy to get wrong. If you are not comfortable identifying the web-server user, database account and deployment process, ask your host or a qualified administrator to review them rather than copying a generic rule from an unrelated server.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.6. Understand the firewall layers
Firewalls can run inside WordPress, at the web server or at a reverse-proxy intermediary. These layers see different traffic and impose different maintenance responsibilities. Ask your host what is already active before adding another control.
| Layer | What it can do | Who maintains it | Best fit |
|---|---|---|---|
| WordPress application or security plugin | Inspect requests after they reach PHP and apply WordPress-aware rules, login controls or activity checks. | Primarily the site owner; it consumes site resources and must remain compatible with WordPress. | Sites needing application-aware controls when the owner can maintain an additional extension. |
| Web server | Reject or rate-limit requests before WordPress runs, enforce server rules and protect other hosted paths. | Usually the host or server administrator. | Owners with managed server access or a host that offers configured server-level protection. |
| Reverse proxy | Filter traffic before it reaches the origin, absorb some abusive traffic and centralize edge rules. | The proxy operator and site owner share configuration and monitoring. | Sites whose DNS, TLS and origin routing support an intermediary layer. |
There is no evidence here for ranking named products by effectiveness. Choose the layer that matches your architecture and your ability to operate it. Several overlapping products can create false confidence, duplicate blocking, increase latency or lock out legitimate visitors. Document which layer blocks what, how to review events and how to disable a rule safely.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Questions for your host
- Is a web-application firewall or network firewall enabled, and at which layer?
- Who updates its rules and responds to false positives?
- Are backups stored separately from the live account, and how is a restore requested?
- Which PHP, database and web-server versions are supported?
- Can you provide staging, access logs, malware response or emergency rollback?
A host protects infrastructure under its control. You remain responsible for the WordPress application, its users, plugins, themes and content.
7. Use a maintenance workflow that preserves functionality
Security fails when changes are made without ownership, testing or a way back. Use this repeatable workflow for updates and hardening changes:
- Inventory: list core, themes, plugins, administrators, external integrations and scheduled jobs.
- Classify: mark each extension as essential, optional, unused, maintained or untrusted.
- Back up: capture files and database, then confirm the restore procedure.
- Stage: reproduce the site in an isolated environment when the change could affect checkout, login, publishing or private data.
- Change one group at a time: update or reconfigure related components so a failure has a clear cause.
- Test: exercise both front-end and administrator workflows, integrations and scheduled tasks.
- Monitor: review error logs, uptime and user reports after deployment.
- Record: note the change, result, responsible person and rollback command or procedure.
This process lets you keep an essential plugin active while still treating every update or permission change as a controlled production change.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minute8. Troubleshoot common hardening failures
An update causes a fatal error or blank page
- Use the host’s recovery mode or maintenance access if available.
- Restore the known-good files and database rather than deleting random plugin files.
- Check the PHP and WordPress compatibility information for the extension.
- Reproduce the update on staging, then contact the maintained plugin author or a qualified administrator with the error details.
Two-step authentication locks out an administrator
- Use a previously stored backup code or registered secondary method.
- Ask another trusted administrator to follow the documented recovery process.
- If the identity provider is unavailable, use the host’s verified emergency procedure and rotate credentials afterward.
- Do not disable 2FA permanently just because one device was lost; replace the factor and test recovery.
A firewall blocks legitimate visitors
- Identify whether the block occurred at the proxy, web server or WordPress layer.
- Review the event and narrow the rule instead of disabling every protection.
- Test from the affected network and from a neutral connection.
- Document the exception and monitor it for abuse.
A restrictive permission change breaks updates
- Restore the previous permissions from your documented change.
- Determine which process needs write or schema-change access.
- Grant the minimum temporary access required, perform the update, then revoke it if your deployment model allows.
- Have the host or a qualified administrator review the final arrangement.
9. A practical review checklist
- There is a recent backup containing both files and database data.
- A restoration has been demonstrated in an isolated environment.
- WordPress is on the latest major release that your site supports.
- Active plugins and themes come from trusted sources and are maintained.
- Unused plugins and themes are removed after dependency checks.
- Every administrator has a unique strong password.
- Two-step authentication is enabled, with tested recovery codes or an alternate factor.
- Any security key is confirmed to work with the specific self-hosted 2FA system.
- Privileged accounts and former staff access have been reviewed.
- Dashboard file editing and file/database privileges match your deployment needs.
- The host’s firewall, backup and recovery responsibilities are documented.
- At least one person knows how to roll back the last change.
Review the checklist after major WordPress releases, hosting changes, staff changes or the replacement of an essential plugin. The exact interval should reflect how often your site changes and how quickly you can respond, not an arbitrary calendar rule.
What “secure enough” looks like
A well-maintained WordPress site can keep its essential plugins enabled while reducing avoidable risk. It has a current, restorable copy; supported core and extensions; protected administrator accounts; a deliberately small and trusted plugin set; permissions that limit unnecessary damage; and firewall controls assigned to the layer best suited to the host and architecture.
That arrangement does not guarantee that an attack will never succeed. It means a vulnerability, stolen credential or faulty update is less likely to become a total outage—and that you have a tested way to contain and recover when prevention is not enough.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →
