Installing a massive all-in-one security plugin on a free or budget shared hosting account often backfires: live traffic loggers bloat your MySQL database, malware file scanners max out your I/O limit, and your site goes down with an HTTP 503 Service Unavailable error.
Here is how to harden your WordPress site with zero PHP overhead using built-in server rules and our free webmaster utilities.
Is Free Hosting Holding Your Website Back?
Free hosting is great for testing, but strict CPU, inode, and Entry Process limits can knock your site offline once Google starts indexing your pages. Run our 60-second check to see what your site actually needs:
1. Lock Down `wp-config.php` Permissions & Rotate Cryptographic Salts
Your wp-config.php file holds your raw MySQL database password and login cookie encryption keys:
- Open our Free WordPress wp-config.php & Cryptographic Salt Generator to generate 8 fresh 64-character secret keys (`AUTH_KEY`, `SECURE_AUTH_SALT`, etc.)—rotating these immediately logs out any unauthorized sessions.
- Add
define( 'DISALLOW_FILE_EDIT', true );to disable the built-in theme/plugin code editor inside `/wp-admin/`. - Set `wp-config.php` file permissions to
600(or `640`) using cPanel File Manager (verify exact octal codes in our Linux chmod Calculator).
2. Block `/xmlrpc.php` & Directory Browsing in `.htaccess`
Unless you use the mobile Jetpack app or automated remote publishing, blocking public access to xmlrpc.php and disabling directory indexing stops 90% of automated bot probes before PHP even boots. Generate the exact rules in one click with our Free .htaccess Security & Redirect Generator.
3. Enable Cloudflare Free WAF & Strong Admin Credentials
Route your DNS through Cloudflare’s Free CDN and turn on Bot Fight Mode so malicious crawlers are blocked at the network edge. Finally, never use `admin` as your username, and generate a 24-character high-entropy password in our Cryptographic Password Generator.
Frequently Asked Questions (FAQ)
Why do security plugins slow down WordPress on free or shared hosting?
Full-suite security plugins run continuous PHP file scans and log every bot hit inside your MySQL database, which rapidly consumes CPU, RAM, and inodes on entry-level shared hosting.
How can I block brute-force attacks without a WordPress plugin?
Place your domain behind Cloudflare’s free DNS/WAF, disable unauthenticated XML-RPC hits in .htaccess, and use a cryptographic 24-character admin password.
What file permission should wp-config.php have on shared hosting?
Set wp-config.php to 600 or 640 so other users on the same shared server cannot read your database credentials or authentication salts.