Secure WordPress on my IBM-i System

The ultra‑simple version

If you want the “Give it to me Quick and Dirty” checklist:

• Update everything
• Use strong passwords and 2FA
• Install Wordfence
• Back up daily
• Use HTTPS
• Don’t install junk plugins

Do those six things and your WordPress site becomes harder to hack than an old RPG program with no comments.

The best and simplest way to secure WordPress

1. Keep everything updated

WordPress core, themes, and plugins should always be on the latest stable version. Most hacks exploit old code, not new code.

2. Use as few plugins as possible

Every plugin is another door into your site. Fewer doors means fewer break‑ins. Stick to reputable, well‑maintained plugins only.

3. Install a lightweight security plugin

Not a kitchen‑sink monster, just something simple like:

• Wordfence (free version is enough - I like this one!)

• iThemes Security (basic hardening)

• Sucuri (firewall optional)

These handle brute‑force protection, file change monitoring, and basic hardening.

4. Use strong passwords and 2FA

This alone blocks 99 percent of automated attacks. Admin accounts should always use:

• Long, random passwords

• Two‑factor authentication (via plugin or hosting provider)

5. Disable the default “admin” username

If you still have a user literally named “admin,” delete or rename it. Attackers always try that one first.

6. Limit login attempts

Either via your security plugin or server config. This stops brute‑force bots instantly.

7. Back up regularly

A secure site is great, but a recoverable site is better. Use:

• Local IFS Backups of your /www/* folder\

• UpdraftPlus

• Jetpack Backup

• Hosting‑level snapshots

Daily backups are ideal (obviously)

8. Use HTTPS everywhere

Installing HTTPS on IBM i is really about three moving parts working together:

• Digital Certificate Manager (DCM)
• IBM HTTP Server (powered by Apache)
• A TLS certificate (self-signed or real like Let’s Encrypt)

A free Let’s Encrypt certificate is enough. No excuses.

9. Lock down file permissions

On any platform, not just IBM-i:

• wp-config.php should not be writable

• wp-content/uploads should be writable but nothing else

• No 777 permissions ever

10. Disable XML‑RPC unless you need it

Most people don’t. It’s a common attack vector.

That feels like a lot right?

It's not, don't sweat it, let's go through each of these steps in order. Dive into the next lessonm 

Keep everything updated