How to harden WordPress with Softaculous.

Open WordPress Manager

Find your WordPress installation in Softaculous.

Log in to cPanel and open Softaculous Apps Installer. Open WordPress Manager, then locate the WordPress installation you want to secure.

Open the Security Measures for that installation. Softaculous can also apply measures to multiple WordPress installations when more than one site is selected.

Good Baseline

Start with the measures that suit most WordPress sites.

These measures generally reduce unnecessary exposure without changing normal front-end WordPress behaviour.

• Restrict access to files and directories — sets safer permissions, including 0600 for wp-config.php, 0644 for other files and 0755 for directories.
• Block access to .htaccess and .htpasswd — prevents these configuration files from being served publicly.
• Turn off pingbacks — disables XML-RPC pingbacks that can be abused for unwanted traffic and DDoS reflection.
• Disable file editing in WordPress Dashboard — removes the built-in theme and plugin source editor from wp-admin.
• Block directory browsing — prevents visitors from listing files in directories where an index file is absent.
• Forbid execution of PHP scripts in wp-includes — reduces the ability to directly execute unexpected PHP files from that directory.
• Forbid execution of PHP scripts in wp-content/uploads — helps prevent uploaded PHP files from being executed.
• Block access to sensitive files — restricts public access to files that may reveal credentials or useful technical information.

Check Before Enabling

Some measures can affect particular site features.

Admin Username

Change the default administrator username if it is still “admin”.

Softaculous can replace the default admin username with a randomly generated administrator username. This removes one predictable value attackers commonly try during automated login attacks.

If your administrator username is already something unique, this particular measure is not necessary.

Apply Carefully

You do not have to enable every measure at once.

Security hardening works best when it matches how the site is actually used. Apply the baseline measures first, then add the compatibility-sensitive measures when you know the site does not depend on the feature being restricted.

Softaculous manages these changes for you, so you do not need to manually edit wp-config.php or .htaccess for each measure.

What Hardening Does Not Replace

Keep WordPress and its software updated.

Hardening reduces the available attack surface, but it cannot make vulnerable or compromised software safe. Keep WordPress core, plugins and themes current and remove anything you no longer use.

• Install updates — keep WordPress, plugins and themes on supported versions.
• Use trusted software — avoid nulled, pirated or unknown plugins and themes.
• Use strong passwords — especially for WordPress administrators and cPanel.
• Use two-factor authentication — where available, protect administrator access with 2FA.
• Review administrator accounts — remove old or unexpected users.
• Keep backups — maintain recoverable backups before major changes or updates.