WordPress Security Benchmark

This benchmark answers the question, “What do I verify?” It is meant for security engineers, auditors, and sysadmins who need prescriptive controls they can assess consistently across a real stack.

Controls are organized in two tiers. Essential Hardening covers the baseline configurations required for any WordPress site on this stack — the minimum standard for a defensible deployment. Defense-in-Depth covers additional controls that reduce attack surface, limit lateral movement, and increase resilience — recommended for production environments or any site where the cost of compromise is high.

Each control includes a description, a rationale, an audit command, and a remediation step for supported WordPress releases on the LEMP/LAMP stack.