Soft2Hosting

WordPress Security on Shared Hosting: wp-config Protection, Permissions & XML-RPC Hardening

29 Sep 2026 · 3 min read

Securing a WordPress website on shared hosting does not require root server access or complex command-line scripts. By configuring standard file permissions through cPanel File Manager, restricting access to wp-config.php, disabling the legacy XML-RPC interface via .htaccess, and enforcing two-factor authentication, site owners can prevent brute-force attacks and unauthorized file tampering while staying within shared hosting boundaries.

Understanding Shared Hosting Security Isolation

Modern shared hosting platforms utilize virtualization wrappers and secure process isolation (such as CageFS) to ensure that individual user accounts remain completely separated. However, website vulnerabilities almost always originate inside the web application itself, through outdated plugins, insecure file permissions, or weak administrative passwords. Applying proactive security hygiene within your cPanel account prevents automated botnets from compromising your site.

Step 1: Enforce Strict File and Directory Permissions

File permissions dictate who can read, write, or execute files within your account. Open cPanel File Manager, navigate to your WordPress installation directory (usually public_html), and review permission values:

Directories: Set to 755 (drwxr-xr-x). This allows the web server process to navigate folders while restricting write access exclusively to the account owner.
Standard Files: Set to 644 (-rw-r--r--). HTML, CSS, JavaScript, and image files should be readable by public visitors but writable only by the account owner.
Never Use 777 Permissions: Setting any file or folder to 777 makes it writable by anyone, creating an immediate security vulnerability.

Securing wp-config.php Permissions

The wp-config.php file stores your raw database credentials, table prefixes, and cryptographic security salts. Protect it by setting its permissions to 600 (owner read/write only) or 640:

In cPanel File Manager, locate wp-config.php in your root directory.
Right-click the file and select Change Permissions.
Ensure Owner has Read and Write checked, while Group and World permissions are unchecked. Save changes.

Step 2: Disable the Built-In File Editor

By default, WordPress allows administrators to edit PHP theme and plugin files directly from the WordPress admin dashboard (under Appearance → Theme File Editor). If an attacker compromises an administrator password, this feature enables them to inject malicious web shells into your site.

Disable this feature completely by adding this single line to your wp-config.php file just before the line that says /* That's all, stop editing! Happy publishing. */:

define( 'DISALLOW_FILE_EDIT', true );

Step 3: Block XML-RPC Brute Force Attacks

The WordPress XML-RPC API (xmlrpc.php) was originally introduced to allow remote mobile publishing. Today, it is frequently exploited by automated bots to execute amplified brute-force password guesses and DDoS attacks. If you do not use the WordPress mobile application or Jetpack, you should disable external access to XML-RPC.

Open your root .htaccess file in cPanel File Manager and insert these rules at the very top:

# Block external access to xmlrpc.php
<Files xmlrpc.php>
Require all denied
</Files>

Step 4: Protect Uploads Directory and Prevent PHP Execution

A common attack vector involves uploading malicious PHP backdoor scripts disguised as images into the WordPress media library (/wp-content/uploads/). Under normal operation, the uploads directory should only contain media files, never executable PHP code.

To block PHP execution inside the uploads folder, create a new .htaccess file directly inside the /wp-content/uploads/ directory containing:

# Deny PHP execution in uploads directory
<Files *.php>
Require all denied
</Files>

Step 5: Disable Directory Browsing

If your website directory lacks an index.html or index.php file, web servers might display a directory index listing all files and folders. This exposes plugin directories and site structures to automated vulnerability scanners. Add this directive to your root .htaccess file:

# Disable directory browsing
Options -Indexes

Website Hygiene Checklist for Shared Hosting

Change Default Database Table Prefix: Avoid using the default wp_ table prefix during installation. Use a unique prefix like s2h_7b_ to block basic SQL injection scripts.
Update Core, Plugins, and Themes: Enable automated minor core updates and review plugin updates weekly. Vulnerable third-party plugins account for the vast majority of WordPress security incidents.
Enforce Two-Factor Authentication (2FA): Install a reputable security plugin (such as Wordfence or Two-Factor) to require an authenticator code on all administrator logins.
Remove Unused Plugins and Themes: Inactive plugins remain accessible on the filesystem. Delete any theme or plugin that is not actively in use.

Built-in Protection on Soft2Hosting Plans

Soft2Hosting shared hosting accounts come equipped with free AutoSSL certificates, LiteSpeed web server caching, and automated backup routines (weekly on Starter Pro, daily on Business Pro and Enterprise Pro plans). If an accidental configuration error or plugin malfunction occurs, you can restore clean files and databases with a single click.

Explore secure shared hosting plans on Soft2Hosting Web Hosting.