How to Secure a WordPress Site on a VPS

WordPress powers a huge share of the web, which makes it a favourite target for automated attacks. Running it on your own VPS means you own the security — and that's an advantage, because you can lock it down properly instead of relying on a shared host's defaults. Here's a practical, layered checklist.

Start with the server itself

WordPress security begins below WordPress. Secure the VPS first:

• Use SSH keys and disable password login — see how to set up SSH keys and how to disable root SSH login.
• Enable a firewall, allowing only what you need:

sudo ufw allow OpenSSH
sudo ufw allow 'Nginx Full'
sudo ufw enable

• Install fail2ban to block brute-force attempts — see how to set up fail2ban.
• Enable automatic security updates — see enable automatic security updates on Linux.

Our full securing your first Linux VPS checklist covers the baseline.

Always use HTTPS

Encrypt all traffic with a free Let's Encrypt certificate:

sudo certbot --nginx -d yoursite.com -d www.yoursite.com

Certbot also sets up auto-renewal. See free SSL certificates with Let's Encrypt for detail.

Harden WordPress itself

Now the application layer:

• Keep core, themes and plugins updated — outdated plugins are the number-one entry point. Enable automatic updates for minor releases.
• Remove unused themes and plugins entirely; don't just deactivate them.
• Use strong admin passwords and enable two-factor authentication via a plugin.
• Change the default admin username — never leave it.
• Limit login attempts to blunt brute-force attacks.
• Set correct file permissions:

sudo find /var/www/yoursite -type d -exec chmod 755 {} \;
sudo find /var/www/yoursite -type f -exec chmod 644 {} \;

• Disable file editing in the dashboard by adding to wp-config.php:

define('DISALLOW_FILE_EDIT', true);

Back up so you can recover

Security isn't only prevention — it's recovery. Keep automatic, off-server backups of files and the database so you can restore quickly after any incident. Our how to back up a VPS guide covers reliable, restorable backups. Test a restore before you need it.

Add a web application firewall and rate limiting

Beyond hardening the server and WordPress, you can filter malicious traffic before it does damage. Two layers help most:

• A web application firewall (WAF). A WAF inspects incoming requests and blocks known attack patterns — SQL injection attempts, malicious bots, and probes for known plugin vulnerabilities. You can run one at the server level (ModSecurity) or via a security plugin or CDN.
• Rate limiting on wp-login.php and the REST API. These are the most-attacked endpoints. Nginx can rate-limit them so brute-force and abusive traffic is throttled before it reaches PHP:

limit_req_zone $binary_remote_addr zone=login:10m rate=5r/m;
location = /wp-login.php {
    limit_req zone=login burst=3 nodelay;
    include snippets/fastcgi-php.conf;
    fastcgi_pass unix:/run/php/php-fpm.sock;
}

Combined with fail2ban watching your auth logs, this makes automated login attacks far less effective.

Monitor, and have a recovery plan

Security is a process, not a one-time setup. Assume something will eventually go wrong and make sure you'd catch it and recover fast:

• Watch your logs. Nginx access and error logs, plus WordPress activity, reveal probing and suspicious behaviour early — make reviewing them a regular habit, and consider monitoring server resources so an attack that drives up load is visible too.
• File-integrity monitoring alerts you if core files change unexpectedly — often the first sign of a compromise.
• Keep tested, off-server backups. The fastest recovery from any incident is restoring a known-good backup — see how to set up automated backups on a VPS and actually test a restore.
• Know your response steps ahead of time: isolate the site, restore from a clean backup, rotate all passwords and salts, then patch whatever let the attacker in.

A hardened server plus a rehearsed recovery plan means even a worst-case incident is a manageable inconvenience rather than a disaster.

Where Nxeon fits

Nxeon's NVMe KVM VPS give you full root to apply every layer here — firewall, fail2ban, SSL, correct permissions — plus one-click images to start from a clean baseline. See WordPress VPS hosting, the security page, or compare plans on pricing. New to hardening WordPress? Pair this with best VPS for WordPress.

FAQ

How do I secure a WordPress site on a VPS?

Layer your defences: secure the server (SSH keys, firewall, fail2ban, auto-updates), force HTTPS, then harden WordPress itself — updates, strong passwords, 2FA, correct file permissions and disabled dashboard editing — and keep off-server backups.

What's the most common way WordPress sites get hacked?

Outdated plugins and themes. Automated bots scan for known vulnerabilities in un-updated components. Keeping everything current, and removing what you don't use, closes the most common door.

Do I need a security plugin?

A reputable security plugin helps with login limiting, 2FA and scanning, but it's not a substitute for server-level hardening, updates and backups. Use both layers together for real protection.

How often should I back up WordPress?

Frequently enough that you wouldn't lose important data — daily for active sites, more often for stores. Store backups off the server and test a restore periodically so you know recovery works.

Ready to lock it down? See WordPress VPS hosting or the security page.