How to secure and harden your WordPress site

Applies to: All plans.

Before you start: You will need your WordPress admin login and access to your client area at my.maxinodes.com. Most steps happen inside WordPress itself; the platform-level protection (ModSecurity with the OWASP rule set, server-side malware scanning, CageFS isolation) is already switched on for you.

Most WordPress hacks come down to a weak password, an out-of-date plugin, or too much unused software lying around. Fix those three things and you have closed the door on the vast majority of attacks. Here is how to harden your site on Maxinodes.

1. Use strong logins and turn on 2FA

Your admin account is the single biggest target, so make it hard to break into.

In your WordPress dashboard, go to Users -> Profile and set a long, unique password (use the Generate Password button).
Avoid the username admin. If you have one, create a new administrator account with a different name, log in as that user, then delete the old admin account (reassigning its posts to the new user).
Install a reputable two-factor authentication (2FA) plugin and enable it for every administrator. After this, logging in needs the password and a one-time code from an authenticator app.
Limit failed login attempts with a security or login-limit plugin so bots cannot guess endlessly.

Result: Even if someone learns your password, they still cannot get in without your second factor.

Protect your client area and cPanel logins too — both support 2FA. Turn it on for the client area from the account/profile menu (top right) at my.maxinodes.com.

2. Keep core, plugins and themes updated

Out-of-date software is the most common way sites get compromised. Updates usually contain security fixes, so apply them promptly.

In WordPress, open Dashboard -> Updates and apply any pending core, plugin and theme updates.
Turn on automatic updates for plugins and themes you trust (each plugin lists an Enable auto-updates link under Plugins -> Installed Plugins).
Take a backup before any major update so you can roll back if something breaks — see How to back up and restore WordPress.

Managed plans: managed updates and patching are part of the service, so we help keep things current for you. Self-Managed plans are self-serve — updating WordPress is your responsibility.

3. Run fewer plugins (and remove what you do not use)

Every plugin and theme is extra code that can carry a vulnerability, so the fewer you run, the smaller your attack surface — and the lighter your site sits within your plan's CloudLinux resource limits.

Go to Plugins -> Installed Plugins and delete (not just deactivate) anything you no longer use. Deactivated plugins still contain code on disk.
Do the same under Appearance -> Themes — keep one active theme plus one default fallback, and delete the rest.
Only install plugins and themes from the official WordPress.org directory or a trusted commercial vendor. Never install "nulled" or pirated premium plugins — they are a common source of malware.

Result: A lean install is faster, easier to keep updated, and gives attackers far fewer things to exploit.

4. Let the server-level protection do the heavy lifting

Every Maxinodes node runs a security stack that is always on — there is nothing to install or configure:

ModSecurity with the OWASP Core Rule Set filters common attack patterns (SQL injection, XSS, path traversal) at the web-server level, before the request ever reaches WordPress.
Server-side malware scanning watches account files and reports anything malicious to our team. It is a scan we run, not one you start from cPanel, and it reports rather than repairs — so if something is found, cleaning up is still a job for you (or for us, on Managed).
CageFS isolates your account from every other account on the server, and cPHulk blocks password-guessing against cPanel, FTP and SSH.
AutoSSL issues and renews a free Let's Encrypt certificate automatically, so your site can be served over HTTPS — see Free SSL (AutoSSL) and how to force HTTPS.

One gap to cover yourself: cPHulk protects the server's logins, not /wp-login.php. Use a login-limit or 2FA plugin for your WordPress admin, as in step 1 above.

If you suspect your site has been compromised (unexpected redirects, spam pages, warnings from Google), contact us with your domain and the details so we can investigate — see How Maxinodes protects your site.

5. A few more quick wins

Send WordPress email through your real mailbox. We do not host mailboxes on the hosting server, so use an SMTP plugin pointed at your Professional Email (Microsoft 365 or Google Workspace) account rather than the local server. See How email works at Maxinodes.
Keep your own backups. Self-Managed plans include self-restore backups via JetBackup in cPanel; Managed plans get daily off-site backups kept 30 days. Either way, keep an independent copy of anything you cannot afford to lose.
Use cPanel's built-in tools. Under the Security section of cPanel you will find IP Blocker, Hotlink Protection and Leech Protection for extra control.

Troubleshooting this task

The 2FA plugin locked me out. Disable the plugin temporarily by renaming its folder in cPanel -> Files -> File Manager (under wp-content/plugins), then log in and reconfigure it.
An update broke my site (white screen). Restore from a backup or deactivate the offending plugin — see Fixing the WordPress white screen of death.
A security plugin is using too many resources. Heavy scanners can push you into your CloudLinux limits. Reduce its scan frequency, since we already scan for malware at the server level. See Understanding CloudLinux resource limits (LVE).