# Fix file and directory permissions recursively via SSH
find /var/www/html -type d -exec chmod 755 {} +
find /var/www/html -type f -exec chmod 644 {} +

# Ensure wp-config.php is write-protected from web-server processes
chmod 440 /var/www/html/wp-config.php
chown www-data:www-data /var/www/html/wp-config.php

# Automated backup script using WP-CLI and database dumps
#!/bin/bash
TIMESTAMP=$(date +"%F_%H-%M-%S")
BACKUP_DIR="/var/backups/wordpress"
DB_NAME="wordpress_prod"
DB_USER="wp_user"
DB_PASS="secure_password"

mkdir -p $BACKUP_DIR

# Export database
mysqldump -u $DB_USER -p$DB_PASS $DB_NAME | gzip > "$BACKUP_DIR/db_$TIMESTAMP.sql.gz"

# Archive web root files excluding media uploads
tar --exclude="$BACKUP_DIR" -czf "$BACKUP_DIR/files_$TIMESTAMP.tar.gz" /var/www/html

# Sync to encrypted remote storage (e.g., AWS S3)
aws s3 cp "$BACKUP_DIR/db_$TIMESTAMP.sql.gz" s3://sitesuraksha-backups/database/
aws s3 cp "$BACKUP_DIR/files_$TIMESTAMP.tar.gz" s3://sitesuraksha-backups/files/

# Purge local backups older than 7 days
find $BACKUP_DIR -type f -mtime +7 -exec rm {} +

# Nginx configuration snippet to rate-limit access to wp-login.php
limit_req_zone $binary_remote_addr zone=login_limit:10m rate=1r/s;

server {
    # Existing server blocks...
    
    location = /wp-login.php {
        limit_req zone=login_limit burst=5 nodelay;
        include fastcgi_params;
        fastcgi_pass unix:/var/run/php/php8.2-fpm.sock;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    }
}

<?php
/
 * Plugin Name: SiteSuraksha Site-Specific Functionality
 * Description: Encapsulates custom site logic without modifying themes.
 * Version: 1.0.0
 * Author: SiteSuraksha Engineering
 */

if ( ! defined( 'ABSPATH' ) ) {
    exit; // Exit if accessed directly.
}

function sitesuraksha_custom_admin_notice() {
    echo '
SiteSuraksha security hardening active.
';
}
add_action( 'admin_notices', 'sitesuraksha_custom_admin_notice' );

8. Leaving Default Installation Artifacts and Identifiers Active

Automated exploit toolkits check for default installation parameters, such as the `admin` username, default database table prefixes (`wp_`), and unprotected `xmlrpc.php` endpoints. Leaving these configurations unchanged simplifies reconnaissance for attackers.

During initial provisioning, always assign a unique database prefix and disable unused protocols like XML-RPC if your application relies entirely on the REST API for remote integrations.

# Apache configuration to block access to xmlrpc.php completely
<Files xmlrpc.php>
    Order Deny,Allow
    Deny from all
</Files>

9. Disregarding Mobile Responsiveness and Adaptive Viewports

Search engines enforce mobile-first indexing, evaluating user experience and DOM rendering performance primarily through viewport simulations. Designing layouts with fixed pixel widths or unconstrained media elements breaks mobile rendering flows, increases bounce rates, and damages organic search visibility.

Use fluid CSS Grid and Flexbox layouts coupled with comprehensive CSS media queries to guarantee seamless scaling across arbitrary device viewports.

10. Skipping Routine Database Maintenance and Bloat Pruning

Over time, the WordPress database accumulates substantial bloat, including infinite post revisions, orphaned post meta, expired transients, and spam comment entries. This accumulation causes inefficient query execution plans within MySQL or MariaDB, degrading overall application responsiveness.

Implement scheduled database cleanup routines to purge transient records and restrict the maximum number of retained post revisions.

// Add this constant to wp-config.php to limit post revisions
define( 'WP_POST_REVISIONS', 5 );

// Clean up expired transients via WP-CLI
wp transient delete --expired

11. Lacking Comprehensive SSL/TLS Configuration and HSTS Enforcement

Operating an insecure HTTP endpoint exposes user credentials and session tokens to man-in-the-middle (MitM) interception. However, merely installing an SSL certificate is insufficient; administrators must also enforce secure transport protocols and eliminate mixed-content resource loading.

Configure HTTP Strict Transport Security (HSTS) headers at the web server layer to instruct client browsers to communicate exclusively over encrypted channels.

# Nginx HSTS and SSL hardening configuration
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-XSS-Protection "1; mode=block" always;

12. Poor Link Management and Unhandled 404 Error Cascades

Broken internal and external links frustrate users and waste crawler crawl budget. When users or search engine bots encounter unhandled 404 errors frequently, domain authority and user retention metrics drop.

Audit site architecture regularly using automated crawlers, and implement intelligent redirection rules within Nginx or via server-level configuration blocks rather than relying on resource-heavy PHP redirection plugins.

13. Ignoring Server Error Logs and Diagnostic Telemetry

PHP error logs, web server access logs, and database slow-query logs record critical system events. Disregarding these logs often means overlooking silent fatal errors, deprecated function warnings, or ongoing brute-force attacks.

Configure centralized log aggregation and enable detailed debugging parameters exclusively within isolated non-production environments to prevent sensitive stack traces from leaking to public visitors.

// wp-config.php debugging configuration for staging environments
define( 'WP_DEBUG', true );
define( 'WP_DEBUG_DISPLAY', false );
define( 'WP_DEBUG_LOG', '/var/log/wordpress/php-error.log' );

14. Overlooking Comprehensive Caching Configurations and TTFB Optimization

Generating dynamic PHP pages for every incoming HTTP request drains server resources and increases latency. Without a robust caching strategy, Time to First Byte (TTFB) spikes under moderate traffic loads.

Deploy a multi-tier caching architecture combining object caching (Redis or Memcached) for database query results with full-page reverse proxy caching (Nginx FastCGI cache or Varnish) to serve static HTML snapshots directly to anonymous visitors.

15. Violating the Principle of Least Privilege in User Access Control

Granting Administrator privileges to every contributor, content editor, or agency partner introduces unnecessary security risks. If a single low-level user account is compromised via phishing, the attacker gains total control over the underlying server infrastructure.

Enforce the Principle of Least Privilege. Assign custom roles with restricted capabilities tailored precisely to each user's operational requirements.

16. Failing to Monitor Post-Deployment Uptime and Performance Regressions

Software deployments and server infrastructure updates can introduce regressions that go unnoticed until reported by end-users. Relying on reactive notification models damages brand reputation and user trust.

Establish automated synthetic monitoring probes that test HTTP response codes, SSL certificate expiration dates, and core transaction flows (such as user registration or cart checkout) at regular intervals.

Production Verification Checklist

Verify your WordPress deployment against the following matrix before pushing updates to production: