How to Secure WordPress on a VPS: Complete WordPress Hardening Guide 2026 

A VPS gives you control over the server running WordPress, including SSH access, firewall rules and system updates. That control also makes it important to understand which security tasks belong to you and which are covered by your hosting plan.

Protect WordPress at both the application and server levels. Updates, access controls, HTTPS, backups and monitoring work together; a security plugin does not replace server maintenance.

The command examples below target an Ubuntu VPS with sudo access. Confirm the site path, service names and PHP/web-server user for your installation before making changes. Back up the site and configuration, keep an SSH session open and test changes on staging where possible.

Key Takeaways

Why Is WordPress Security Different on a VPS?

On shared hosting, the provider manages the underlying server. With a VPS, your responsibilities depend on the management included in your plan. Tasks may include Firewall rules, SSH configuration, operating system updates and intrusion prevention.

A VPS with root access lets you configure:

• Network exposure
• Authentication policies
• Server software and packages
• Firewall rules
• File permissions
• Monitoring systems

This extra control enables much better security hardening, but at the same time can be dangerous when making incorrect configuration decisions.

Keep WordPress Core, Plugins and Themes Updated

Use of old software versions is one of the leading vulnerabilities leading to attacks on WordPress websites. Hackers search for vulnerable versions of plugins and inactive themes on the internet. Upgrading WordPress helps to plug the security loopholes before they are used by hackers to gain access to the website.

Take a restorable backup before updates, and test plugin and theme compatibility on staging. Run WP-CLI from the correct WordPress directory as the site owner. Ubuntu package upgrades may also require a service restart or reboot.

sudo apt update && sudo apt upgrade -y

The following command is used to update the core of WordPress using the WP CLI method:

wp core update

Plugins are updated as follows:

wp plugin update --all

Themes are updated by:

wp theme update --all

Secure WordPress Login Access

Use unique administrator credentials and two-factor authentication. Limit login attempts and review administrator accounts; an account’s permissions matter as much as its name.

Use a password manager to create and store a strong, unique password for each account. Enable two-factor authentication for an additional login check.

A login protection plugin can limit repeated attempts against WordPress. Server controls can provide another layer of protection.

You can automate things by using Fail2Ban combined with proper log analysis.

One must always check which accounts are active with the help of WP CLI:

wp user list

Review accounts with administrator access before removing anything:

wp user list --role=administrator

Disable XML-RPC When It Is Not Needed

XML-RPC supports remote publishing and some integrations. It can also expose authentication and pingback functionality to abuse. Disable it only after confirming that your site does not need it.

You can verify the availability of XML-RPC using the following command:

curl -I https://yourdomain.com/xmlrpc.php

To block XML-RPC in NGINX if not required:

location = /xmlrpc.php {
deny all;
}

The following will work in Apache:

<Files "xmlrpc.php">
Require all denied
</Files>

Do not forget to validate the syntax before reloading the services.

NGINX:

sudo nginx -t

Reload with:

sudo systemctl reload nginx

Apache:

sudo apachectl configtest

Reload with:

sudo systemctl reload apache2

Install SSL and Force HTTPS

The implementation of HTTPS is critical for current WordPress security. Credentials and cookies must not be transmitted using any unsecured connections.

An SSL/TLS certificate encrypts traffic between the browser and server. Let’s Encrypt offers free certificates; Certbot can obtain and renew them. Use the package for your active web server.

Install Certbot on Ubuntu:

sudo apt install certbot python3-certbot-nginx -y

For Apache use:

sudo apt install certbot python3-certbot-apache -y

Generate certificates with NGINX:

sudo certbot --nginx

Or Apache:

sudo certbot --apache

Verify automatic renewal after installation:

sudo certbot renew --dry-run

Redirect HTTP requests to HTTPS after confirming that the certificate works and the site URLs are configured correctly.

Set Correct File Permissions

File permission issues are one of the most frequent server-based security vulnerabilities in WordPress.

Permissions depend on the ownership model. Directories at 755 and files at 644 are common starting points, but writable upload paths and sensitive configuration files need a separate review.

First, navigate to the folder where WordPress was installed:

cd /var/www/html

Setting directory permissions:

sudo find . -type d -exec chmod 755 {} \;

File permission settings:

sudo find . -type f -exec chmod 644 {} \;

Restrict wp-config.php to the owner and, where needed, the PHP process’s group. Mode 600 works only when PHP runs as the owner; 640 may be appropriate with a correctly assigned group. Do not make a change that prevents PHP from reading the file.

stat -c '%U:%G %a %n' wp-config.php

Inspect ownership before changing it. Keep application files owned by the deployment account and grant the web/PHP user write access only where needed, such as uploads. Making the entire installation writable by www-data is not a universal hardening rule.

stat -c '%U:%G %a %n' . wp-content wp-config.php

Never use chmod 777 because global write permission causes major vulnerabilities.

Set Up the UFW Firewall

A firewall dictates what traffic can connect to the server. UFW offers robust network security.

Install UFW if it is not installed:

sudo apt install ufw -y

Allow the actual SSH listening port before enabling UFW. OpenSSH usually covers port 22; a custom SSH port needs its own allow rule. Keep console access available and confirm another SSH session works before proceeding.

sudo ufw allow OpenSSH

Then allow connections via HTTP and HTTPS:

sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

Turn on the firewall:

sudo ufw enable

Viewing the current firewall rules:

sudo ufw status verbose

Only allowed traffic should be enabled. Any open ports represent another potential attack vector.

Set Up Fail2Ban

Fail2Ban is among the most potent VPS hardening software because it blocks IP addresses that engage in malicious activities.

Install Fail2Ban:

sudo apt install fail2ban -y

Enable and start the service:

sudo systemctl enable fail2ban
sudo systemctl start fail2ban

Review the current Fail2Ban status before adding an SSH jail:

sudo fail2ban-client status

Add or merge the SSH settings in a local override file, preserving existing custom rules:

sudo nano /etc/fail2ban/jail.d/sshd.local

This Ubuntu example reads SSH events from the systemd journal. Set port to the actual SSH port if it is not 22:

[sshd]
enabled = true
port = ssh
backend = systemd
maxretry = 5
bantime = 3600

Validate the configuration, then restart Fail2Ban:

sudo fail2ban-client -t
sudo systemctl restart fail2ban

View active jails:

sudo fail2ban-client status

Fail2Ban performs excellently if used alongside a firewall and SSH hardening.

Harden SSH Access

SSH controls the VPS itself. That makes it one of the highest value attack targets.

The best improvement is replacing password authentication with SSH keys.

Generate the key on your own computer, not on the VPS. Keep the private key there and protect it with a passphrase:

ssh-keygen -t ed25519 -C "[email protected]"

Copy the public key to the server:

ssh-copy-id username@server_ip

First confirm a second login with the key and a non-root sudo account. Keep the current session open, then review the server’s SSH configuration and any included files:

sudo nano /etc/ssh/sshd_config

Disable password authentication:

PasswordAuthentication no

Disable direct root login:

PermitRootLogin no

Validate SSH configuration before reloading on Ubuntu:

sudo sshd -t
sudo systemctl reload ssh

sudo sshd -T | grep -E '^(passwordauthentication|permitrootlogin|pubkeyauthentication)'

Secure Your Database

Database security matters because WordPress stores user accounts and content inside MySQL or MariaDB.

Run the MySQL security script right after installation:

sudo mysql_secure_installation

Create dedicated database users inside MySQL instead of using root:

CREATE USER 'wpuser'@'localhost' IDENTIFIED BY 'strongpassword';
GRANT ALL PRIVILEGES ON wordpress.* TO 'wpuser'@'localhost';
FLUSH PRIVILEGES;

Remote database access should remain disabled unless necessary. Strong database credentials combined with least privilege access enhance security.

Backups and Recovery

Backups are part of security because prevention alone is never enough.

A failed update or malware infection or accidental deletion can destroy a website quickly if no recovery plan exists.

Store backups outside the public web directory. Set a private backup directory and replace /var/www/html with the verified site path:

umask 077
backup_stamp=$(date +%F-%H%M%S)
backup_dir="$HOME/wp-backups/$backup_stamp"
mkdir -p "$backup_dir"
tar -czf "$backup_dir/files.tar.gz" -C /var/www/html .

Export the database:

mysqldump --single-transaction -u wpuser -p wordpress > "$backup_dir/database.sql"

Export the matching database during the same backup window. The example assumes the WordPress database is named wordpress; replace the account and database names. Automate backups, keep an offsite copy and test a restore. Busy sites may require maintenance mode or a coordinated snapshot for consistency.

Malware Scanning and Security Plugins

Security plugins such as Wordfence and Sucuri can help with malware scanning and file integrity checks. Use them alongside server maintenance and access controls.

Linux malware scanners come in handy in terms of Linux servers:

Install ClamAV:

sudo apt install clamav clamav-daemon -y

The clamav-freshclam service normally updates signatures. Check it rather than starting a second updater against the same signature database:

sudo systemctl status clamav-freshclam

Run scans:

sudo clamscan -r /var/www/html

Combining WordPress scanning with server monitoring creates stronger layered protection.

Monitoring and Logs

Monitoring improves security because suspicious behaviour becomes visible earlier.

Useful logs include SSH authentication logs and firewall activity as well as WordPress login records.

Check SSH authentication attempts:

sudo journalctl -u ssh

Monitor NGINX access logs:

sudo tail -f /var/log/nginx/access.log

For Apache:

sudo tail -f /var/log/apache2/access.log

Monitor Fail2Ban activity:

sudo fail2ban-client status sshd

Continuous visibility helps detect brute force attempts and unauthorized activity before incidents escalate.

WordPress Security Checklist

A practical checklist improves consistency across deployments and reduces the chance of forgetting critical hardening steps.

Your WordPress security VPS checklist should confirm that:

• The WordPress core continues to be updated. 
• Unnecessary plugins have been deleted. 
• HTTPS is in effect. 
• XML RPC has been blocked when necessary. 
• File permissions are proper. 
• The UFW firewall is enabled. 
• Fail2Ban is working. 
• SSH keys are in place. 
• Database user passwords are strong. 
• Backups are functional. 
• Monitoring is in operation.

The idea behind this checklist is highly effective for agencies and developers managing multiple WordPress installations.

Why VPS Hosting Improves WordPress Security

A VPS allows more control over server settings than shared hosting. Extra control does not automatically make it more secure; the server still needs updates, careful configuration and recovery procedures.

You can set up firewall rules, install Fail2Ban, harden SSH connections, use proper permission management, reduce the number of exposed services, and monitor your logs. Such control will provide you with a chance to establish a robust security policy and infrastructure.

Why Use UltaHost VPS for WordPress Hardening?

UltaHost VPS hosting provides the root access necessary for advanced WordPress hardening.

The reason why this is important is that WordPress security VPS solutions require server-level configuration as well as application-level configurations.

Users with VPS hosting have the option to utilize UFW, fail2ban, secure SSH access, and create permission systems that are not easy to accomplish in limited shared hosting environments.

Choose a VPS when you need this control and have the resources to maintain it, or select a managed service with responsibilities clearly defined.

Conclusion

WordPress hardening combines maintained software, restricted access, HTTPS, suitable file ownership, monitoring and tested backups. A VPS gives you tools to configure these controls, but the configuration and ongoing maintenance determine the result.

FAQ

Usama Sajid

A word wizard passionate about making technology simple. The list of topics which I have covered includes VPS hosting, cloud computing, cyber security, server management, and website performance. Follow me for simplified tech jargon.