Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Secure a WordPress Multisite network as a shared control plane, not as a collection of unrelated sites. Reduce and protect Super Admin access, patch the entire software stack, require HTTPS and SFTP, restrict network settings and uploads, verify every plugin and theme, maintain tested off-server backups, monitor changes, and review Multisite-specific rewrite rules before deployment. A single compromised account, shared user record, or network-activated component can affect every site in the installation.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
Why Multisite security is different
WordPress Multisite runs several sites from one WordPress installation. Each site has its own content tables, but the user table is shared. Core files, plugins, themes, the database server, and many configuration decisions are also shared. A vulnerability or stolen credential at the network layer can therefore cross site boundaries.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Networks can use subdirectory addresses, such as example.com/site-a, or domain and subdomain addresses, such as site-a.example.com or a mapped external domain. Choose the addressing model during setup and document it with DNS, TLS certificate, rewrite, and operational ownership requirements. Changing the model later is a migration project, not a casual setting change.
The official Multisite handbook page was first published on March 28, 2023 and lists an update on October 14, 2026. Its architecture guidance should be read alongside WordPress’s Hardening WordPress and user-role documentation. As WordPress puts it, “Fundamentally, security is not about perfectly secure systems.” The objective is to reduce the chance of compromise, limit blast radius, detect abuse quickly, and recover predictably.
#1 Best Overall
1. Protect Super Admins before anything else
Super Admin is the highest-impact role in a network. A Super Admin can manage sites, users, themes, plugins, network settings, and code that runs across multiple sites. Start with an inventory rather than assuming the current list is correct.
Audit the account list
- Open the Network Dashboard and review the Super Admin list.
- Remove former staff, contractors, test accounts, and shared logins.
- Give each remaining administrator an individual account so actions are attributable in logs.
- Review the list on a schedule and whenever someone changes role or leaves the organization.
Do not use one account for a team. Shared credentials make it impossible to identify the person who changed a plugin, created a site, or altered registration rules, and they complicate emergency revocation.
Recommended Free Tools
Use strong, unique authentication
Require a long password that is unique to the WordPress account and store it in an approved password manager. Add two-step authentication for every Super Admin and for any hosting, database, DNS, source-control, or deployment account that can alter the network. WordPress warns: “A strong password is necessary not just to protect your blog content. A hacker who gains access to your administrator account is able to install malicious scripts that can potentially compromise your entire server.”
Protect recovery channels as carefully as the primary login. A secure password is undermined if an abandoned email account, reusable recovery code, or unprotected hosting panel can reset it.
Separate daily work from emergency authority
Use the least powerful role that completes a task. Site administrators should manage their own content and settings, not network-wide code or users. Reserve Super Admin for network operations and keep a documented emergency account in a secure location. Test emergency access without leaving the account permanently active on an everyday workstation.
2. Patch the entire stack, not just WordPress
Keep WordPress core, every plugin and theme, PHP, the operating system, the web server, and the database on supported stable releases. WordPress notes that older versions stop receiving security maintenance and that exploit details commonly become public after a fix is released. Delaying an update can therefore leave a known vulnerability exposed.
Build a repeatable update process
- Record the current WordPress, PHP, database, web-server, plugin, and theme versions.
- Take a verified database and file backup before changing production.
- Apply updates in a staging copy of the network first.
- Test login, network administration, every critical site, forms, media uploads, scheduled jobs, domain mappings, and caching.
- Deploy during a maintenance window and record what changed.
- Check error logs and authentication logs after deployment, then confirm that backups still complete.
Network activation makes a plugin available across the installation, but it does not make insecure code safe. Remove abandoned, unused, or duplicated plugins and themes instead of merely deactivating them. Files left on disk can still contain exploitable code, and an administrator may accidentally reactivate them later.
Control where code comes from
Install plugins and themes from WordPress.org or a vendor with a clear maintenance and security process. Verify package provenance and keep a written inventory of approved versions. Limit installation and network activation to trusted administrators. Do not upload unreviewed ZIP files, nulled software, or code received through an unsolicited message.
3. Encrypt administration and server access
Require HTTPS for login, wp-admin, the Network Dashboard, XML-RPC or API endpoints that you actually use, and every mapped domain. Redirect HTTP to HTTPS only after confirming that certificates cover the network’s subdomains or mapped domains. Renew certificates before expiration and monitor renewal failures.
Use SFTP or another encrypted file-transfer method instead of unencrypted FTP. Protect SSH keys with passphrases, restrict who can use them, and remove keys when staff or vendors no longer need access.
Be cautious with an extra HTTP authentication layer
An additional Basic Authentication prompt can reduce exposure to the WordPress login screen, but a naive rule can break AJAX requests and other administrative endpoints. If you add a second layer, test the Network Dashboard, media handling, plugin screens, scheduled tasks, REST requests, and any front-end workflow that depends on an authenticated request. Keep a documented bypass or recovery path for administrators when the extra layer is misconfigured.
4. Apply least privilege to files and the database
File permissions
WordPress core, wp-admin, and wp-includes should be writable only where an update or deployment process specifically requires it. Treat wp-content, especially uploads, as user-supplied content. Prevent script execution in upload directories where your server configuration supports it, while testing media delivery and image processing after the change.
Use ownership and permissions that let the web process read required files without granting it broad write access. A deployment account can write code during a controlled release, then return production files to a non-writable state. Never solve an update problem by making the entire installation world-writable.
Database privileges
A database account normally needs SELECT, INSERT, UPDATE, and DELETE for routine operation. Core and plugin updates may also need structural privileges to create or alter tables, indexes, or columns. Reducing privileges can be worthwhile, but only with a tested upgrade procedure and a current backup; otherwise an update can fail halfway through and leave the network inconsistent.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsUse a dedicated database account for the network, restrict where it can connect from, protect its secret outside the web root, and rotate it after a suspected compromise. Do not grant administrative database rights to the WordPress account merely for convenience.
5. Lock down Network Settings
Network Settings is the main policy surface for limiting what site administrators and registrants can do. Review it after installation and whenever the network’s purpose changes.
Registration policy
Disable open user and site registration unless it is a documented requirement. If registration is necessary, require an approval workflow and monitor new accounts and sites. Decide whether users may create sites themselves or whether a Super Admin must create every site.
Banned names and email domains
Reserve names that could impersonate the organization, support staff, or system functions. Use allowed or blocked email-domain rules to keep registrations within the intended community. These controls reduce abuse; they do not replace account verification, rate limiting, or review of newly created sites.
Uploads and file types
Set an upload-size limit appropriate to the content you host. Allow only file types the network actually needs, and remove risky extensions from the permitted list. Test legitimate workflows such as images, documents, video, and downloadable game assets after changing the policy. A file extension filter is not a malware scanner, so keep server-side execution controls and monitoring in place.
Site-administrator menus
Restrict menus that expose unnecessary plugins, themes, updates, or network-wide settings to site administrators. Give each site team enough control to operate its site without allowing changes that affect every tenant. Recheck menu restrictions after adding a plugin because new screens can expose capabilities you did not intend to delegate.
6. Decide who can install and activate code
Separate “can manage a site” from “can introduce executable code.” Site administrators should not be able to install arbitrary plugins or themes on a shared network. Network activation should require a trusted administrator who has reviewed compatibility, licensing, maintenance status, and the plugin’s data access.
Keep a change record containing the package name, version, source, reviewer, activation scope, and rollback plan. For a plugin that is needed on only one site, prefer a configuration that limits it to that site rather than network activation. Remove code that no longer has an owner or business purpose.
7. Choose and document the network URL architecture
Subdirectory and domain/subdomain networks have different DNS, certificate, cookie, rewrite, and operational requirements.
| Decision | Subdirectory network | Domain or subdomain network |
|---|---|---|
| Address pattern | example.com/site-a |
site-a.example.com or a mapped domain |
| DNS work | Usually one primary host | May require wildcard or per-domain DNS records |
| TLS coverage | Primary certificate must cover the host | Certificate strategy must cover subdomains and mapped domains |
| Migration risk | Path and permalink assumptions are widespread | Cookies, redirects, DNS, and domain mappings add dependencies |
| Operational ownership | Centralized under one host | May involve several domain owners and support teams |
Confirm the choice before production sites are created. Document DNS records, certificate renewal, canonical URLs, redirects, cookie scope, rewrite rules, and who can approve a new mapped domain.
8. Handle Multisite rewrite rules with care
Multisite requires more complex rewrite support than a single-site installation. A generic hardening snippet copied from a single-site tutorial can break media delivery or administrative requests.
The official guidance specifically warns that a common rule blocking wp-includes/*.php can stop ms-files.php from generating images. Omitting that blocking line preserves media behavior but provides less blocking. There is no universal “safe” snippet independent of the server, WordPress version, URL architecture, and whether legacy media handling is in use.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute- Copy the current Apache or Nginx configuration into a staging network.
- Identify which rules are supplied by WordPress, which are supplied by the host, and which were added manually.
- Test front-end pages, administrator screens, REST and AJAX requests, image thumbnails, full-size media, uploads, redirects, and every domain-mapped site.
- Check server error logs and browser network responses for blocked PHP or 404 requests.
- Deploy only after the staging tests pass, and keep the previous configuration for immediate rollback.
Document the trade-off when you omit a blocking rule for compatibility. A rule that improves one threat boundary but disables network media is not a successful hardening change.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.9. Back up the whole network and rehearse restoration
A usable Multisite backup includes the database and files. The database contains the shared user table plus each site’s content tables and network settings. Files include WordPress core, plugins, themes, uploads, and configuration needed to recreate the installation.
Backup requirements
- Run backups on a schedule that matches how much data the network can afford to lose.
- Keep copies separate from the production server so an attacker cannot erase every copy.
- Encrypt backups in transit and at rest, and restrict who can restore or download them.
- Define retention periods and label backup timestamps clearly.
- Include network configuration, DNS and certificate records, deployment files, and secrets-management procedures in the recovery documentation without storing secrets in plain text.
Test a restore
- Restore a recent database and file set into an isolated environment.
- Confirm that the network loads, users can authenticate, and every critical site is present.
- Test uploads, media URLs, scheduled jobs, domain mappings, plugin activation, and outbound email.
- Measure how long the restoration takes and record any manual repairs.
- Update the runbook and repeat after major WordPress, PHP, database, or hosting changes.
A backup that has never been restored is an assumption, not a recovery plan. WordPress describes backups and recovery preparation as ways to reduce downtime after compromise.
10. Monitor activity and prepare an incident response
Enable retention and review for authentication events, failed logins, privilege changes, new users and sites, plugin and theme installation or activation, network-setting changes, file changes, and database or hosting access. Send alerts somewhere other than the production server so an attacker cannot quietly delete the evidence.
Useful alert conditions
- A new Super Admin or unexpected role change.
- Repeated failed logins followed by a successful login.
- Plugin or theme installation outside a maintenance window.
- Unexpected changes to registration, upload, email-domain, or menu restrictions.
- New files in upload directories or PHP execution attempts from those directories.
- Changes to DNS, certificates, SSH keys, database credentials, or rewrite configuration.
Incident sequence
- Confirm the alert and preserve logs, timestamps, and affected URLs.
- Disable or lock the suspected account and revoke active sessions and access tokens.
- Isolate the affected site or network components without destroying evidence.
- Rotate WordPress, hosting, database, SSH, API, and email credentials that may have been exposed.
- Identify unauthorized code or data changes and determine the earliest known compromise.
- Restore clean files and database content from a verified backup, then patch the entry point.
- Review every site because shared users and code can extend the impact beyond the first symptom.
- Document the timeline, corrective actions, notifications, and follow-up controls.
11. Managed versus self-managed hosting
Hosting does not remove the network owner’s security responsibilities. Compare services on the controls that matter to Multisite rather than on a generic “managed” label.
Quick Recap
| Evaluation area | Questions to ask a managed host | Questions for self-managed infrastructure |
|---|---|---|
| Patch ownership | Who patches the operating system, PHP, web server, database, and control panel, and how are emergency fixes communicated? | Who is on call, and how is a supported-version inventory maintained? |
| Isolation | How are networks, databases, backups, and customer accounts separated? | Can one compromised site reach other tenants or management interfaces? |
| Backups | What is retained, where is it stored, and are restores tested for Multisite? | Who runs, encrypts, verifies, and periodically restores backups? |
| Logging and alerts | Are authentication, file, server, and network-setting events available to you? | How will logs be centralized, retained, and reviewed? |
| WAF and response | Can rules be tuned for domain-mapped subsites, and what is the support response during an incident? | Who handles false positives, rule updates, and emergency containment? |
| Multisite support | Does the platform support your URL model, wildcard TLS, rewrites, cron, and large networks? | Have DNS, certificates, rewrites, and capacity been tested under your architecture? |
12. A practical security review checklist
- Super Admins are inventoried, individual, necessary, and protected by unique passwords and two-step authentication.
- WordPress, plugins, themes, PHP, the operating system, web server, and database are on supported stable releases.
- Unused plugins and themes are removed, and code sources are approved.
- HTTPS protects administration and SFTP protects file transfer.
- Core directories are not broadly writable; uploads cannot execute unintended scripts.
- Database privileges support required updates without granting unnecessary administrative access.
- Registration, banned names, email domains, upload limits, file types, and site-admin menus match the network policy.
- Subdirectory or domain architecture, DNS, TLS, and rewrite ownership are documented.
- Apache or Nginx rules have been tested for
ms-files.php, media, AJAX, REST, and mapped domains. - Database and file backups are encrypted, off-server, retained, and restored successfully in an isolated environment.
- Authentication, privilege, code, network-setting, and server events are logged and alerted.
- An incident runbook identifies account suspension, isolation, credential rotation, clean restoration, and post-incident review steps.
What to do first on an existing network
- List Super Admins, hosting users, database users, SSH keys, active plugins, themes, mapped domains, and scheduled backups.
- Remove unnecessary accounts and code, then enforce unique passwords, two-step authentication, HTTPS, and SFTP.
- Take and verify a complete database-plus-files backup before changing permissions or applying updates.
- Patch the full stack in staging, including PHP, web server, database, core, plugins, and themes.
- Apply registration, upload, file-type, email-domain, and menu restrictions that match the network’s actual use.
- Review rewrite rules with special attention to media handling and
ms-files.php. - Restore the backup into an isolated environment and run the incident procedure as a tabletop exercise.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
