Hardening WordPress Beyond Plugins: OS-Level & Server-Level Techniques

Most WordPress security guides focus heavily on plugins. While plugins help, they are not enough.
Real security starts below WordPress itself — at the OS and server level.

In this guide, you’ll learn how to harden your WordPress installation using:

• fail2ban for brute-force protection
• NGINX security rules
• Proper file permissions
• Disabling XML-RPC correctly

Why Server-Level Security Matters

Attackers don’t care about your plugins — they target:

• Login endpoints
• XML-RPC abuse
• Misconfigured file permissions
• Server vulnerabilities

If your server is weak, WordPress will be vulnerable regardless of plugins.

1. Protecting WordPress with fail2ban

fail2ban monitors logs and blocks IPs after repeated failed attempts.

Install fail2ban

sudo apt update
sudo apt install fail2ban

Create WordPress Jail

sudo nano /etc/fail2ban/jail.local

[wordpress]
enabled = true
port = http,https
filter = wordpress
logpath = /var/log/nginx/access.log
maxretry = 5
findtime = 600
bantime = 3600

Create Filter

sudo nano /etc/fail2ban/filter.d/wordpress.conf

[Definition]
failregex = ^<HOST>.*"(POST /wp-login.php|POST /xmlrpc.php)
ignoreregex =

Restart fail2ban

sudo systemctl restart fail2ban

Now repeated login or XML-RPC attacks will be automatically blocked.

2. NGINX Security Rules

Block Access to Sensitive Files

location ~* /(wp-config.php|.env|readme.html|license.txt) {
    deny all;
}

Disable PHP Execution in Uploads

location ~* /wp-content/uploads/.*\.php$ {
    deny all;
}

Limit Login Attempts (Rate Limiting)

limit_req_zone $binary_remote_addr zone=login:10m rate=1r/s;

location = /wp-login.php {
    limit_req zone=login burst=3 nodelay;
}

Block XML-RPC (if not needed)

location = /xmlrpc.php {
    deny all;
}

3. Correct File Permissions

Improper permissions are one of the most common security issues.

Recommended Permissions

• Directories → 755
• Files → 644
• wp-config.php → 600

Apply Permissions

find /var/www/html -type d -exec chmod 755 {} \;
find /var/www/html -type f -exec chmod 644 {} \;
chmod 600 /var/www/html/wp-config.php

Correct Ownership

chown -R www-data:www-data /var/www/html

4. Disabling XML-RPC Properly

XML-RPC is often abused for brute-force and DDoS amplification attacks.

Best Method: Block at Server Level

location = /xmlrpc.php {
    deny all;
}

Alternative: Disable via PHP

<?php
\add_filter( 'xmlrpc_enabled', '__return_false' );

⚠️ Server-level blocking is preferred because it stops the request earlier.

Bonus Hardening Tips

Disable File Editing in Admin

<?php
define( 'DISALLOW_FILE_EDIT', true );

Hide WordPress Version

<?php
\remove_action( 'wp_head', 'wp_generator' );

Restrict wp-admin by IP

location /wp-admin {
    allow YOUR_IP;
    deny all;
}

Common Mistakes to Avoid

• Relying only on security plugins
• Leaving XML-RPC enabled unnecessarily
• Using 777 permissions
• Not monitoring logs

FAQ

Final Thoughts

True WordPress security starts at the server level.
By combining OS-level tools like fail2ban with proper server configuration, you can stop most attacks before they even reach WordPress.

Plugins help — but real protection happens before PHP executes.