Hardening WordPress Security on Nginx: Disabling XML-RPC, Restricting WP-Admin & File Permissions

Hardening WordPress Security on Nginx: Disabling XML-RPC, Restricting WP-Admin & File Permissions

Author: Mir Alamin (Principal Web Architect) | Published: July 18, 2026 at 04:30 PM | Reading Time: 22 min read | Category: Security | Tags: WordPress on LEMP, Security, Nginx, Hardening, Web Server

---

Executive Summary

WordPress's popularity makes it a primary target for brute-force attacks, XML-RPC amplification exploits, and malicious PHP upload execution inside media directories. While security plugins offer basic defenses, true enterprise-grade security must be enforced at the Nginx web server layer before malicious requests ever reach PHP or WordPress.

This security blueprint covers blocking XML-RPC, restricting /wp-admin/ access by IP address, disabling PHP execution in upload folders, and setting immutable Linux file permissions.

---

1. Blocking XML-RPC Attacks at Nginx Level

xmlrpc.php allows attackers to test hundreds of password combinations in a single HTTP request via multi-call methods, causing high CPU load and credential compromise.

# Block all access to xmlrpc.php directly at Nginx layer
location = /xmlrpc.php {
    deny all;
    access_log off;
    log_not_found off;
}

---

2. Preventing PHP Execution in Uploads & Content Directories

Attackers who bypass form upload validations often upload backdoor shells (shell.php) into /wp-content/uploads/. Block PHP execution in static asset directories:

# Deny PHP execution in wp-content/uploads and wp-includes
location ~* ^/(wp-content/uploads|wp-includes)/.*\.php$ {
    deny all;
}

---

3. Restricting /wp-admin/ & wp-login.php Access by IP Address

Restrict access to the WordPress login page and administration dashboard strictly to trusted staff IP addresses:

# Restrict wp-login.php access
location = /wp-login.php {
    allow 198.51.100.50; # Staff IP
    allow 203.0.113.10;  # Backup Office IP
    deny all;

    include snippets/fastcgi-php.conf;
    fastcgi_pass unix:/run/php/php8.3-fpm.sock;
}

---

4. Production Linux File Ownership & Permission Rules

Ensure web server file ownership prevents unauthorized PHP script modification:

# Set directory ownership to www-data
sudo chown -R www-data:www-data /var/www/wordpress/

# Set standard directory permissions to 755 and file permissions to 644
sudo find /var/www/wordpress/ -type d -exec chmod 755 {} \;
sudo find /var/www/wordpress/ -type f -exec chmod 644 {} \;

# Protect wp-config.php with strict 600 permissions
sudo chmod 600 /var/www/wordpress/wp-config.php

---

5. Security Hardening & Malware Recovery Services

If your WordPress site has been hacked or requires professional security hardening:

• 🔒 Website Hack Recovery & Security Hardening
• 🛠️ Continuous Website Maintenance Plans

---

6. Frequently Asked Questions (FAQ)

Q1: Will disabling XML-RPC break my WordPress site?

No, unless you rely on legacy mobile apps or Jetpack plugins that utilize XML-RPC. Modern WordPress REST API handles all modern integrations securely.

Q2: Why is setting wp-config.php to 600 permission important?

A permission of 600 ensures that only the www-data file owner can read or write database credentials, hiding them from other unprivileged system users.

---

© 2026 WebCare Pro. Authored by Mir Alamin.