From a hosting perspective you want to isolate Wordpress as much as possible - i.e. putting it in a namespace with php-fpm (easiert way is using firejail) and r

From a hosting perspective you want to isolate Wordpress as much as possible - i.e. putting it in a namespace with php-fpm (easiert way is using firejail) and running PHP as a seperate user. You also want to only give it the minimal required access rights to the database. You also need to keep up with security updates and run a supported PHP version - there are still crazy amounts of PHP < 5.6 installs out there :( From Wordpress.org own stats: https://wordpress.org/about/stats/ https://wordpress.org/about/stats/ http://php.net/supported-versions.php http://php.net/supported-versions.php That's 70% of Wordpress installs that run on EOL and unsupported software!!! Besides that update your kernel as soon as possible (reboot or hotpatch e.g. ksplice) and keep userland up to date. There are tons of local root exploits for Linux that help an attacker to attain some serious persistence. Some other ideas I've read is keeping most of Wordpress readonly for the PHP user and use wp-cli (http://wp-cli.org/ http://wp-cli.org/) or similiar tools that update from the shell. You can do this some group membership trickery. It's also possible to almost completely forbid access to web clients to wp-content/plugins and wp-includes if your plugins don't do something stupid. But that's error prone and something you should test. For a simple site with a theme you control and few or none plugin it should work fine through. As a general rule be very conservative regarding plug-ins and themes and spend some time to look at what comes with them.