1. Set Correct WP-File Permissions A. Set 400 for wp-config.php file

   

2. Secure WP-Config File From Hackers Optional

A. Find your document_root path to paste (a) under <?php at the 2nd line on the wp-config.php file to check document_root path > copy the path Optional

B. Create a new wp-config.php file on the upper directory > copy and paste the old config code on the new wp-config.php file > copy the new wp-config.php path >use it on the old wp-config.php as the format of (b)

```php
// A:
echo phpinfo();

// B:
<?php
include("/home/hirendev/wp-config.php");
```

3. Secure the .htaccess and .htpasswd files on any Apache server on .htaccess

A. protect .htaccess

# protect .htaccess
<Files ~ "^.*\.([Hh][Tt][Aa])">
	Order allow,deny
	Deny from all
	Satisfy all
</Files>

OR

B. Protect .htpasswd

# protect .htpasswd
<Files ~ "^.*\.([Hh][Tt][Pp])">
	Order allow,deny
	Deny from all
	Satisfy all
</Files>

OR

C. Protect both files

# protect .htaccess and .htpasswd
<Files ~ "^.*\.([Hh][Tt])">
	Order allow,deny
	Deny from all
	Satisfy all
</Files>

OR

D. Protect all files beginning with a dot

# protect all dot files
<Files ~ "^.*\.">
	Order allow,deny
	Deny from all
	Satisfy all
</Files>

1. Protect wp-config.php file on .htaccess

   # Protect wp-config.php file
   <files wp-config.php>
   order allow,deny
   deny from all
   </files>
   

2. How to Disable Directory Browsing in WordPress on .htaccess

   #Disable Directory Browsing
   Options All -Indexes
   

3. Block WordPress xmlrpc.php requests on .htaccess

   # Block WordPress xmlrpc.php requests
   <Files xmlrpc.php>
   order deny,allow
    deny from all
   allow from 123.123.123.123
   </Files>
   

4. Stop Brute Force by Blocking Author Scans in WordPress on .htaccess

   # BEGIN block author scans
   RewriteEngine On
   RewriteBase /
   RewriteCond %{QUERY_STRING} (author=\d+) [NC]
   RewriteRule .* - [F]
   # END block author scans
   

5. Protect individual files by .htaccess on .htaccess

   # Protect individual file by .htaccess
   <files .htaccess>
   order allow,deny
   deny from all
   </files>
   

6. To prevent anyone from accessing any PHP files in the wp-content/uploads folder. you can create a .htaccess file in the wp-content/uploads folder and add the following code to it:

   # Kill PHP Execution
   <Files ~ ".ph(?:p[345]?|t|tml)$">
   deny from all
   </Files>
   

7. Protect the wp-content directory. The author suggested creating a separate .htaccess file inside the wp-content folder. The suggested snippet looks like this:

   # Wp-content access deny
   order deny,allow
   deny from all
   <files ~ ".(xml|css|jpe?g|png|gif|js)">
   allow from all
   </files>
   

8. Use just Simple Login Captcha (no need to configure)

9. Install the Solid Security plugin and set basic settings