Updates, users, and XML-RPC

WordPress security on a typical site comes down to three habits you control: keep core, themes, and plugins updated; lock down admin users with unique passwords and two-factor authentication; and disable XML-RPC when you do not need it. A security plugin can help afterward, but it does not replace those steps.

Secure admin users first

Begin with the administrator accounts on your WordPress site. A user named admin with a short or reused password is still one of the most common ways sites get taken over. Rename that account if it still exists, set a long unique password, and turn on two-factor authentication in a plugin you will actually keep. On WordPress accounts here, WP Toolkit can surface related checks when it is available on your plan.

Delete administrator access for contractors and former staff who no longer need it. If you use the official mobile app, prefer application passwords instead of leaving XML-RPC open indefinitely. You can also set DISALLOW_FILE_EDIT in wp-config.php so a stolen admin session cannot edit theme or plugin PHP through the dashboard editor. SFTP and WP Toolkit continue to work after that change.

Treat updates as the real patch

Update WordPress core, plugins, and themes on a steady schedule. WP Toolkit can apply those updates for you on accounts that include it. A plugin last updated years ago is still a door for attackers, even when the front end looks fine every day.

Use staging when an update worries you, and keep reliable backups for the ones that surprise you. A web application firewall does not patch vulnerable code inside an abandoned plugin. Treat Toolkit’s vulnerability list as a to-do list, not as a badge that the work is finished.

Turn off XML-RPC when you do not need it

The file xmlrpc.php is how older apps and many bots talk to WordPress. Most sites do not need pingbacks, and the modern path for the official app is the REST API with application passwords. If you do not need those older features, disable XML-RPC so brute-force traffic stops hitting that endpoint.

Heavy abuse against xmlrpc.php can look like odd traffic in metrics and can slow the site for everyone else. Disable it when unused, then add a WAF later if you still want one. Hygiene first means users, passwords, updates, and XML-RPC before extra scanners.

If a site was already compromised, rotate every admin password and rotate the AUTH keys in wp-config.php so existing sessions end. Look in wp-content for PHP files that do not belong to a plugin or theme you installed. Restore from a known-good backup when you need a clean tree. Those basics matter more than installing another scanner on top of unfinished hygiene.