Security theater vs maintainable hardening
Hiding wp-login.php and installing five security plugins feels productive. It rarely beats timely updates, strong credentials, and a restore path that has been tested.
Baseline we apply on retained sites
- Automatic patches for minor core releases; scheduled review for plugins/themes
- Least-privilege users; no shared admin accounts
- 2FA for administrators
- Limit login attempts / WAF rules against credential stuffing
- Disable file editing in the dashboard (
DISALLOW_FILE_EDIT) - Separate staging credentials from production
Backups are part of security
An untested backup is a rumor. We want off-host backups, retention that matches the content velocity, and a restore drill at least once after go-live.
What we watch after launch
Unexpected admin users, modified core files, spikes in 404s on login endpoints, and outbound mail volume. Those signals catch compromise earlier than a yearly audit PDF.
When a site is already owned
Isolate, restore from a known-good backup, rotate all secrets, and only then reopen. Cleaning malware in place on a heavily customized site is how reinfection happens.
Rayaxis maintains WordPress estates for teams that want a calm, boring security posture — the kind that keeps selling pages up.