Introduction
As a server administrator managing environments at 2CO Host, I see thousands of brute-force attacks daily. Most site owners try to stop these with heavy security plugins that bloat the database and slow down the site.
In 2026, the real way to secure a site is by “Hardening” it—stopping attacks at the server level before they even touch your WordPress installation. In this guide, I’ll show you how to lock down your site using LiteSpeed, .htaccess, and wp-config.php tweaks.
1. Disabling the “Big Two” Vulnerabilities: XML-RPC and REST API
Two of the most exploited files in WordPress are xmlrpc.php (used for pingbacks and legacy apps) and the REST API.
- XML-RPC: Unless you are using the Jetpack plugin or the very old WordPress mobile app, you don’t need this. Attackers use it for “DDoS Amplification.”
- The Fix: Don’t use a plugin. Add this to your
.htaccessfile:
Apache
<Files xmlrpc.php>
Order Deny,Allow
Deny from all
</Files>
2. Protecting wp-config.php at the Server Level
Your wp-config.php contains your database credentials. If a hacker gains access, your entire server is at risk.
- The Tweak: Move your
wp-config.phpone directory above your public_html. WordPress automatically looks for it there. - The Code Hardening: Add these lines to the top of your config file to disable the theme/plugin editor (so even if an admin account is hacked, they can’t inject code):
PHP
define( 'DISALLOW_FILE_EDIT', true );
define( 'DISALLOW_FILE_MODS', true );
3. Leveraging LiteSpeed & cpGuard
Since we use LiteSpeed Enterprise at 2CO Host, we have access to reCAPTCHA at the server level.
- Instead of a plugin, we enable the LiteSpeed “Brute Force Protection.” This stops bot attacks at the network layer, saving your CPU from spiking.
- cpGuard Integration: We monitor for malicious scripts like the
txets.phpmalware we saw recently. Real-time scanning at the OS level is 100x more effective than a WordPress malware plugin.
4. Database Security: Changing the Prefix
Default installations use wp_ as the database prefix. This makes SQL injection attacks much easier for bots.
- Pro-Tip: During your fresh 2026 install, always use a custom prefix like
pcf_26_. It’s a small step that stops 90% of automated SQL attacks.
Conclusion: Security is a Layered Approach
Security isn’t about one “magic” plugin; it’s about reducing your attack surface. By moving security to the server level, you not only make your site unhackable but also keep it lightning-fast for your users.