Five checks to reduce WordPress attack surface: admins, file editing, permissions, wp-config.php, uploads

The article argues that reducing the number of entry points on a WordPress site lowers both the chance of compromise and the damage it can cause, though it does not eliminate vulnerabilities. It recommends reviewing five areas: administrator accounts, dashboard file editing, file permissions, the handling of wp-config.php, and PHP execution within uploads. Administrator accounts should be limited to current managers, with smaller roles given to others and every admin account accounted for. Disabling dashboard file editing through a wp-config.php constant removes a route for rewriting server-side code, while noting that a related constant also blocks plugin and theme installs. The author cautions against overly open permissions like 777 and suggests recording the current state before making changes.