How to Secure WordPress Without a Plugin (Manual Hardening Guide)

Why Secure WordPress Manually?

Many developers prefer to secure their WordPress sites manually rather than relying on bloated, heavy security plugins that drag down database performance. If you know what you are doing, you can implement robust security at the server and application level.

Here is how to harden WordPress without clicking "Install Plugin".

1. Hardening via wp-config.php

Your wp-config.php file is the heart of your installation. Add these constants to instantly improve security:

// Disable the plugin and theme file editor
define( 'DISALLOW_FILE_EDIT', true );

// Force SSL for admin logins
define( 'FORCE_SSL_ADMIN', true );

// Disable WP Cron (and run it via server cron instead)
define( 'DISABLE_WP_CRON', true );

2. Securing with .htaccess Rules (Apache)

If you run on an Apache server, your .htaccess file is a powerful firewall. You can use it to block access to sensitive files.

<files wp-config.php>
order allow,deny
deny from all
</files>

<Files xmlrpc.php>
order deny,allow
deny from all
</Files>

Options -Indexes

3. File Permissions

Incorrect file permissions allow hackers to easily write malicious code to your server. Set them correctly via SSH or FTP:

• Directories: 755
• Files: 644
• wp-config.php: 400 or 440 (Read-only)

The Caveat of Manual Security

While manual hardening is fantastic for performance, it has two major flaws:

1. It does not protect against Zero-Day vulnerabilities in third-party plugins. A WAF is required for dynamic payload inspection.
2. It lacks active monitoring. If a file is modified, you won't know unless you manually check.

The Best of Both Worlds: Nexura Security

If you love manual security because you hate bloated databases and slow load times, you should try Nexura Security. Unlike traditional security plugins, Nexura is built with a micro-architecture. It doesn't bloat your database with heavy logs, and its firewall runs natively at the PHP level (via auto_prepend_file) — meaning it acts exactly like a manual server-side firewall, but with the convenience of an auto-updating ruleset.