How to Secure a WordPress Site on a VPS

WordPress powers a huge share of the web, which makes it a favourite target for automated attacks. Running it on your own VPS means you own the security — and that's an advantage, because you can lock it down properly instead of relying on a shared host's defaults. Here's a practical, layered checklist.

Start with the server itself

WordPress security begins below WordPress. Secure the VPS first:

• Use SSH keys and disable password login — see how to set up SSH keys and how to disable root SSH login.
• Enable a firewall, allowing only what you need:

sudo ufw allow OpenSSH
sudo ufw allow 'Nginx Full'
sudo ufw enable

• Install fail2ban to block brute-force attempts — see how to set up fail2ban.
• Enable automatic security updates — see enable automatic security updates on Linux.

Our full securing your first Linux VPS checklist covers the baseline.

Always use HTTPS

Encrypt all traffic with a free Let's Encrypt certificate:

sudo certbot --nginx -d yoursite.com -d www.yoursite.com

Certbot also sets up auto-renewal. See free SSL certificates with Let's Encrypt for detail.

Harden WordPress itself

Now the application layer:

• Keep core, themes and plugins updated — outdated plugins are the number-one entry point. Enable automatic updates for minor releases.
• Remove unused themes and plugins entirely; don't just deactivate them.
• Use strong admin passwords and enable two-factor authentication via a plugin.
• Change the default admin username — never leave it.
• Limit login attempts to blunt brute-force attacks.
• Set correct file permissions:

sudo find /var/www/yoursite -type d -exec chmod 755 {} \;
sudo find /var/www/yoursite -type f -exec chmod 644 {} \;

• Disable file editing in the dashboard by adding to wp-config.php:

define('DISALLOW_FILE_EDIT', true);

Back up so you can recover

Security isn't only prevention — it's recovery. Keep automatic, off-server backups of files and the database so you can restore quickly after any incident. Our how to back up a VPS guide covers reliable, restorable backups. Test a restore before you need it.

Add a web application firewall and rate limiting

Beyond hardening the server and WordPress, you can filter malicious traffic before it does damage. Two layers help most:

• A web application firewall (WAF). A WAF inspects incoming requests and blocks known attack patterns — SQL injection attempts, malicious bots, and probes for known plugin vulnerabilities. You can run one at the server level (ModSecurity) or via a security plugin or CDN.
• Rate limiting on wp-login.php and the REST API. These are the most-attacked endpoints. Nginx can rate-limit them so brute-force and abusive traffic is throttled before it reaches PHP:

limit_req_zone $binary_remote_addr zone=login:10m rate=5r/m;
location = /wp-login.php {
    limit_req zone=login burst=3 nodelay;
    include snippets/fastcgi-php.conf;
    fastcgi_pass unix:/run/php/php-fpm.sock;
}

Combined with fail2ban watching your auth logs, this makes automated login attacks far less effective.

Monitor, and have a recovery plan

Security is a process, not a one-time setup. Assume something will eventually go wrong and make sure you'd catch it and recover fast:

• Watch your logs. Nginx access and error logs, plus WordPress activity, reveal probing and suspicious behaviour early — make reviewing them a regular habit, and consider monitoring server resources so an attack that drives up load is visible too.
• File-integrity monitoring alerts you if core files change unexpectedly — often the first sign of a compromise.
• Keep tested, off-server backups. The fastest recovery from any incident is restoring a known-good backup — see how to set up automated backups on a VPS and actually test a restore.
• Know your response steps ahead of time: isolate the site, restore from a clean backup, rotate all passwords and salts, then patch whatever let the attacker in.

A hardened server plus a rehearsed recovery plan means even a worst-case incident is a manageable inconvenience rather than a disaster.

Where Nxeon fits

Nxeon's NVMe KVM VPS give you full root to apply every layer here — firewall, fail2ban, SSL, correct permissions — plus one-click images to start from a clean baseline. See WordPress VPS hosting, the security page, or compare plans on pricing. New to hardening WordPress? Pair this with best VPS for WordPress.

FAQ

Put this guide to work on Web hosting. From $2.99 a month.