Least privilege, said plainly

Least privilege means every login can do its job and nothing more. You use one SSH key per person, one database user per app, and separate panel access with 2FA. Shared root passwords and a pile of security plugins often create lockouts instead of safety.

The cases we see usually start with access that was too broad. A MySQL root password pasted into several wp-config files turns one leak into several sites. File editors left on, or directories set to 777 so a theme can write cache, hand attackers more than they need. Those choices spend privilege badly and leave you locked out later.

Name the doors you actually use

Panel login, SSH, SFTP, the database, wp-admin, and API tokens are separate doors. Each one should use its own secret, and where you can, its own person. You should be able to revoke access without rebuilding the server. Use deploy tokens for automation, not a human password. Turn on 2FA for the panel, and revoke access the same day someone leaves. Shared team logins make clean revocation almost impossible.

The database user WordPress uses should not hold GRANT ALL on every database. Point phpMyAdmin at that limited user, not root, knowing it can still drop tables inside its own schema. Export a gzip backup before you change grants. An SFTP contractor should see one directory. A WordPress user who only writes posts should not install plugins.

Obscurity is not the same as least privilege

Changing the SSH port is not least privilege. Hiding wp-login while leaving xmlrpc open is not either. CageFS on shared hosting, SSH keys, and a WAF sit in different layers. Match the control to the abuse you are stopping. If a plugin needs delete_plugins only to show a banner, remove the plugin.

1. List who can use SSH, who can reach wp-admin, and which database user the app uses.
2. Replace shared passwords with keys and 2FA, and keep one break-glass panel login.
3. Give the app a database user that is not root, limited to one schema.
4. Log in from a second network before you close the next door, so hotel Wi-Fi is your real test.

If you already locked yourself out, tell us how you still reach the panel. Do not paste a private key. Write down who had access before you tighten anything. Revoking a shared password you cannot name locks out a contractor, or leaves them inside. After a real compromise, copy and rotate first; tightening privilege comes second.