WordPress And The Hosting Account Hardening

WordPress security receives most attention, but the hosting account underneath has its own attack surface. Hardening the hosting account is one layer of defense.

The account password

Strong, unique password for the hosting account. Different from the WordPress admin password.

Use a password manager to generate and store it. Don't reuse passwords across services.

The two-factor authentication

Enable 2FA on the hosting account if supported. Most quality hosts offer this.

The 2FA on hosting prevents account takeover even if the password leaks.

The SSH key authentication

If using SSH for server access, use key-based authentication rather than password.

Keys are much harder to brute-force than passwords. Disable password authentication entirely when keys are configured.

The file permissions

WordPress files should have appropriate permissions: 755 for directories, 644 for files, 600 for wp-config.php.

Overly permissive permissions (777 for everything) make compromises easier.

The unused services

Hosting accounts often include services beyond WordPress: FTP, email, additional applications. Services that aren't used should be disabled.

Each running service is potential attack surface. Disabled services can't be compromised.

The honest framing

Hosting account hardening is one layer in defense-in-depth. The investment is small; the protection is real.

For sites where WordPress is hardened but the hosting account isn't, the weak link matters. Attackers may target the easier path.