The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
You can harden a WordPress site without turning off the plugins that deliver its essential features. The safe approach is layered: create and test a complete recovery point, keep WordPress core and trusted extensions current, protect administrator accounts with strong credentials and two-step authentication, remove only unused or untrusted code, and choose firewall controls that match what your host already provides. These measures reduce risk; they cannot make a site perfectly secure.
What “secure” means when essential plugins must stay active
WordPress Developer Resources states the goal plainly: “Security is not about perfectly secure systems.” Hardening is risk reduction. You are trying to make unauthorized access less likely, limit what an intruder can change if access is gained, detect problems sooner, and restore the site with known-good data. A functioning plugin that handles payments, forms, memberships, search, accessibility, or another core business task may be more important than a simplistic rule to disable every extension.
WordPress.org describes the platform as powering more than 43% of the web (the page does not state a year). That reach makes timely maintenance important, but the percentage is not a measure of the attack probability for your individual site. Your risk depends on exposure, account protection, code quality, hosting controls, backups, and how quickly you can recover.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesUse the following order: establish a rollback point, update the platform and extensions, secure accounts, review plugin trust and necessity, then add or tune controls at the host, server, or WordPress layer. Test each change before making the next one.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
1. Create a recovery point before changing anything
Do not begin by disabling plugins or changing access rules. First make a current backup. WordPress plugin guidance warns that updates can cause problems, and the hardening handbook recommends regular snapshots of the entire installation with a restoration plan.
Back up the complete site
- Database: posts, pages, users, settings, orders, form entries, and plugin data.
- WordPress files: core files, themes, plugins, uploads, and configuration files.
- Server-specific settings: web-server rules, scheduled jobs, PHP settings, and any custom deployment files you need to reproduce the site.
A database-only export cannot restore uploaded media or custom code. A files-only copy cannot restore content and settings. Keep at least one copy outside the live server so a compromised account cannot destroy both the site and its backup.
Prove that the backup can be restored
- Record when the snapshot was made and which WordPress, theme, and plugin versions were active.
- Restore it to a staging environment or another isolated location, not over the production site.
- Check the front end, administrator login, forms, search, media, scheduled tasks, and the workflows supported by your essential plugins.
- Document the restore steps, credentials needed, and the person responsible for approving a rollback.
A job marked “successful” only proves that a backup process ran. It does not prove that the archive is complete, readable, or usable under pressure. The official guidance does not prescribe one universal backup frequency or a particular storage device; choose an interval that matches how much content you can afford to lose and verify it routinely.
Plan a safe maintenance window
List the changes you intend to make, note the current versions, and decide how you will reverse each change. Put a staging copy behind access controls, test updates there when possible, and schedule production work when you can monitor the site. Keep an administrator session open until you have confirmed that the updated site and its essential workflows operate normally.
2. Keep WordPress, themes, and plugins current
Outdated software is a preventable entry point. Update WordPress core, active themes, and active plugins from trusted sources, then remove software that is no longer needed. The WordPress supported-versions guidance identifies only the latest major release as officially supported. Older branches may receive security fixes as a courtesy, but there is no guaranteed support period or promise that every issue will be backported.
Update WordPress core deliberately
- Confirm that your backup and restore test are current.
- Review the current WordPress release information and your host’s supported PHP and database versions.
- Update on staging first if the site has complex integrations or high traffic.
- Check administrator access, public pages, publishing, media uploads, forms, checkout or membership flows, and scheduled jobs.
- Apply the same update to production, monitor logs and key workflows, and record the result.
Do not treat an old major version as a long-term security strategy simply because it still appears to run. If an upgrade path is blocked by a theme or plugin, identify the incompatible component and plan a supported replacement or obtain qualified help rather than leaving the entire installation indefinitely behind.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Evaluate every plugin and theme before updating
| Check | What to verify | Action when the result is poor |
|---|---|---|
| Maintenance activity | Recent releases, clear ownership, and a support channel that still responds. | Find a maintained alternative before the extension becomes an emergency. |
| Compatibility | Its stated compatibility with your WordPress version, PHP version, theme, and other critical extensions. | Test in staging and resolve conflicts before production. |
| Source | Downloaded from WordPress.org or a vendor you know and can verify. | Replace unknown, modified, or unofficial copies. |
| Permissions | Whether it requests file, database, or administrator access that is necessary for its function. | Restrict access where your architecture allows and investigate unexpected requests. |
| Recovery | A current backup exists and you know how to roll back. | Do not update until a usable restore point exists. |
Handle an essential plugin that appears abandoned
Do not disable it reflexively if other parts of the site depend on it. First map what it does, which pages call it, what data it stores, and which users rely on it. Check whether a maintained release exists, whether the vendor offers a migration path, or whether another supported extension can provide the same function. If no safe replacement is immediately available, isolate the decision: keep the plugin only while you reduce exposure, maintain tested backups, restrict administrator access, and set a deadline for replacement. A security professional can help assess a high-impact dependency.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 113. Protect administrator accounts
An attacker who obtains an administrator account can often bypass many plugin-level safeguards. WordPress hardening guidance recommends a strong password plus two-step authentication, not one or the other.
Use unique credentials and least privilege
- Give each person an individual account; do not share one administrator login.
- Use a long, unique password that is not reused on email, hosting, or other services.
- Keep routine work on an account with the lowest role that can perform it. Reserve administrator privileges for tasks that require them.
- Delete former staff accounts or immediately remove their access when responsibilities change.
- Review administrator and editor accounts periodically for unfamiliar names, email addresses, or recent activity.
Add two-step authentication
WordPress’s official account documentation describes security keys, time-based one-time passwords, and backup codes. For a self-hosted site, those methods are available only when the two-factor plugin or identity provider you installed supports them. A hardware key that works for a WordPress.org account is not automatically supported by every self-hosted WordPress login.
| Method | Operational requirement | Recovery consideration |
|---|---|---|
| Time-based one-time password | An authenticator application enrolled for each administrator. | Store the setup or recovery codes securely; plan for a lost or replaced phone. |
| FIDO2 security key | Your installed self-hosted 2FA system must explicitly support security keys. | Register a spare key or another approved recovery method before enforcing the requirement. |
| Backup codes | Codes generated by the account or 2FA system and kept offline. | Treat each code as single-use and regenerate the set after a suspected exposure. |
- Choose the 2FA method your site’s login system supports.
- Enroll one administrator at a time while another verified administrator remains able to recover the account.
- Test a fresh login in a private browser window.
- Test the recovery method before making 2FA mandatory for everyone.
- Record who can reset 2FA and how identity will be verified.
Never remove the only recovery method while testing enforcement. If a key, phone, or code is lost, use the documented recovery process rather than disabling all account protection as a permanent workaround.
4. Keep essential plugins without keeping unnecessary risk
“Essential” should mean required for a documented site function, not merely installed or occasionally interesting. Build an inventory with the plugin name, purpose, owner, version, update source, dependencies, and the pages or workflows that would fail if it were removed.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Classify the installed set
- Required and maintained: Keep active, update after a backup, and test its critical workflow.
- Required but uncertain: Investigate ownership, compatibility, permissions, and replacement options; do not hide the risk by ignoring updates.
- Not required: Deactivate, confirm that nothing depends on it, then remove it and its residual settings according to the vendor’s documented process.
- Unknown: Identify its source and purpose before allowing it to remain active.
Unused plugins and themes enlarge the codebase and may contain vulnerabilities even when their features are not visible. Removing them is different from disabling an extension that a live workflow needs.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Review trust and requested access
Obtain plugins and themes from WordPress.org or known, trusted vendors. Be cautious with extensions that request broad file-writing, database, or code-execution capabilities. WordPress warns that code-execution features can increase the impact of a compromise. Ask what access is necessary, who can trigger it, and whether the feature can be limited to a controlled role or maintenance window.
Use a backup-first update workflow
- Read the extension’s change notes and compatibility indicators.
- Confirm the latest complete backup and the rollback procedure.
- Update one critical extension at a time on staging.
- Exercise the exact function it provides, including edge cases such as user registration, payment, file upload, or email delivery.
- Update production only after the test passes, then monitor for errors and user reports.
If an update breaks the site, use the tested rollback rather than repeatedly switching essential plugins on and off without a diagnosis. Record the failing version, error, affected workflow, and any temporary mitigation so the next decision is informed.
5. Choose firewall protection at the right layer
Firewalls can run inside WordPress as a plugin, at the web-server level, or in a reverse proxy in front of the server. Each layer sees different traffic and assigns different maintenance responsibilities. Ask your host what it already operates before adding another control.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
| Layer | What it can inspect or block | Who usually maintains it | Best fit and cautions |
|---|---|---|---|
| WordPress application/plugin | Requests after they reach WordPress, with knowledge of users, routes, and application behavior. | Site owner or WordPress administrator. | Useful when host controls are limited; consumes application resources and must remain compatible with essential plugins. |
| Web server | Connection and request rules before WordPress executes. | Host or server administrator. | Efficient for server-wide policy; changes can affect every site on the server and require appropriate access. |
| Reverse proxy | Traffic at an intermediary before it reaches the origin server. | Host or proxy administrator, sometimes the site owner. | Can absorb unwanted traffic early; must be configured to preserve legitimate users, caching, uploads, and administrative access. |
Questions to ask your host
- Is a network or web-application firewall active, and at which layer?
- Who updates its rules and responds to false positives?
- Are brute-force controls, malware scanning, rate limits, and logging included, or are they separate services?
- How can you obtain blocked-request details when an essential plugin stops working?
- Can the host restore files and the database independently, and how long are backups retained?
Do not assume that several overlapping security products automatically provide better protection. Select controls your architecture supports and your team can maintain. A rule that blocks legitimate form submissions or administrator requests can create an availability problem while the underlying vulnerability remains.
6. Limit damage if an attack succeeds
Hardening includes containment, not just prevention. WordPress guidance discusses restricting Dashboard file editing and carefully managing file and database privileges, while warning that overly restrictive database privileges can interfere with updates that change database structure.
Restrict high-impact administration carefully
If your team does not need to edit plugin or theme files from the Dashboard, disable or restrict that capability through a tested host or WordPress configuration. Keep a documented way to make legitimate emergency changes. Do not apply a rule you cannot reverse or that prevents the update process from writing required files.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Use least privilege without breaking maintenance
Separate ordinary content work from system administration. Limit who can install extensions, change users, edit settings, or alter server files. At the database layer, grant only what the application needs, but test upgrades and migrations: some releases must change database structure. If a privilege change causes an update failure, restore the known-good configuration, complete the supported migration, and then reassess the minimum permissions.
Free tools Windows power users keep installed
One-click scans. No signup required.
Keep staging and production distinct
Use sanitized data where possible, protect staging with access controls, and prevent search engines or unauthenticated visitors from treating it as a second public site. Never assume a staging copy is harmless: it may contain administrator credentials, private uploads, or vulnerable old code.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.7. Monitor the site and prepare an incident response
Security controls are useful only when someone notices and acts on their signals. Decide where you will review update notices, host alerts, login events, firewall blocks, and backup results. Keep logs long enough to investigate a problem, subject to your host’s storage and privacy policies.
Signs that require investigation
- Unexpected administrator accounts, password-reset emails, or 2FA changes.
- New plugins, themes, files, scheduled tasks, or configuration changes you cannot explain.
- Sudden redirects, injected links, altered content, broken uploads, or unusual outbound email.
- Repeated login failures followed by a successful login from an unfamiliar location.
- Firewall blocks or server errors that begin immediately after an update.
First response steps
- Record the time, symptoms, affected URLs, users, and recent changes.
- Contact the host and preserve relevant logs before they rotate.
- Use a separate trusted device to change compromised administrator credentials and revoke suspicious sessions.
- Isolate the site or place it in a maintenance state if continued access could harm visitors or data.
- Restore a known-good backup only after identifying which credentials and software versions must also be replaced or updated.
- Recheck every administrator, plugin, theme, scheduled task, and integration before returning to normal operation.
If legal, payment, health, or personal data may be involved, follow your organization’s incident and notification requirements. A restore alone does not prove that an attacker no longer has access.
8. A maintenance routine that preserves functionality
| Routine | Actions | Evidence to keep |
|---|---|---|
| Every maintenance event | Confirm backup, update one logical group, test essential workflows, and record results. | Version numbers, test outcome, and rollback point. |
| Regular account review | Remove former users, verify roles, review 2FA enrollment, and regenerate exposed recovery codes. | Approved user list and review date. |
| Regular plugin review | Confirm purpose, source, maintenance status, compatibility, and requested permissions. | Inventory with owner and replacement plan for uncertain items. |
| Regular restore test | Restore the whole site in isolation and exercise critical workflows. | Successful restore record and documented procedure. |
| After host changes | Recheck firewall behavior, caching, uploads, cron jobs, email, and administrator access. | Host configuration notes and observed exceptions. |
The official material does not set one schedule that fits every site. Set intervals based on publishing frequency, transaction volume, staffing, and the maximum outage or data loss your organization can accept.
Common mistakes and how to correct them
“Disable every plugin to be safe”
This can remove essential functions without addressing the root problem. Inventory dependencies, update trusted extensions, remove only unused or untrusted code, and replace abandoned components through a tested migration.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
“A security plugin replaces updates and backups”
It does not. Application firewalls and scanners are one layer. Core, theme, and plugin maintenance, account protection, host controls, and recoverable backups remain necessary.
“The host handles all security”
The host controls infrastructure it operates; the site owner still controls WordPress accounts, extensions, content, and configuration. Confirm the boundary in writing and test what happens when a request is blocked or a backup must be restored.
“A hardware key automatically works with WordPress”
Support depends on the 2FA plugin or identity provider used by the self-hosted installation. Verify compatibility and enroll a recovery method before enforcement.
“A successful backup job means recovery is guaranteed”
Only a test restore demonstrates that the files and database are complete and usable. Keep the procedure current as the site changes.
Final checklist
- Complete files-and-database backup exists outside the live server.
- Restore has been tested in an isolated environment.
- WordPress is on the latest major release that your environment supports.
- Active themes and trusted plugins are maintained, compatible, and updated after a backup.
- Unused or unknown extensions are removed after dependency checks.
- Every administrator has a unique strong password and two-step authentication.
- Recovery codes or a second approved factor are available and protected.
- Host firewall and backup responsibilities are documented.
- Dashboard file editing and privileges are restricted only where tested and reversible.
- Someone owns monitoring, update testing, and incident response.
Following this sequence preserves the plugins your site actually needs while reducing avoidable exposure. Revisit it whenever WordPress, a critical extension, the host, or the people with administrator access change.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
