Block PHP execution in untrusted folders Go to public_html and you’ll see three folders called wp-includes , wp-admin , and wp-content , like so To protect your website from backdoor access files, you need to create a .htaccess file and upload it to your site’s/wp-includes/ and /wp-content/uploads/ directories. You need to paste the following code in your .htaccess file. <Files *.php> deny from all </Files> For openlitespeed RewriteCond %{REQUEST_URI} ^.*(\/|php)$ [NC] RewriteRule .* - [F,L] Disable file editor in wp-config.php define( 'DISALLOW_FILE_EDIT', true ); Change security keys To log in easily, WordPress stores your credentials so you don’t have to enter your credentials every time you want to login. But what’s important here is that it’s stored in an encrypted form. https://api.wordpress.org/secret-key/1.1/salt/ copy paste from this url For busniess websites only Disallow plugin installations There are ...