Most hacked WordPress sites are not targeted by anyone in particular. Automated bots scan millions of sites looking for outdated plugins, weak passwords and forgotten admin accounts, and they break into whatever is easiest. That is actually good news, because it means solid WordPress security is mostly about not being the easy target. The fifteen steps below are the ones I apply to client sites, roughly in order of how much protection they give for the effort involved.
Accounts and logins
1. Use strong, unique passwords for every account
Every WordPress user, your hosting control panel, your database and your FTP or SFTP accounts should have a long, unique password. A password manager makes this painless. Reused passwords are a common way in, because a leak from some unrelated website hands attackers a working login.
2. Turn on two-factor authentication
Two-factor authentication (2FA) means a stolen password alone is not enough to log in. Enable it at least for every administrator, and ideally for editors too. Several reputable security plugins add it, and many hosts offer it on their control panels as well. Turn it on there too.
3. Give people only the access they need
Not everyone needs to be an Administrator. Someone who writes blog posts can be an Author or Editor. A developer who has finished a project should have their account removed or downgraded. Review your user list every few months and delete accounts that are no longer used.
4. Limit login attempts
Bots try thousands of password combinations against the login page. Limiting failed attempts, or adding a firewall rule that blocks repeat offenders, shuts this down. Avoid using “admin” as a username, since it is the first one bots try.
Updates and software
5. Keep WordPress core, plugins and themes updated
Outdated plugins are one of the most common causes of compromised WordPress sites. Security fixes are released regularly, and once a vulnerability is public, bots start scanning for it quickly. Minor core updates are usually automatic; plugins and themes need attention. On business-critical sites, I recommend updating on a staging copy first, or at least taking a backup right before updating.
6. Delete what you are not using
Deactivated plugins and unused themes can still contain vulnerable code that sits on your server. If you are not using it, delete it. Keep one default WordPress theme installed as a fallback, and remove the rest.
7. Only install plugins and themes from trustworthy sources
Stick to the official WordPress.org directory or the developer’s own site. “Nulled” (pirated) premium plugins are a well-known source of hidden malware. Before installing anything, check when it was last updated, how many active installs it has and whether the developer responds to support questions.
8. Run a supported PHP version
Older PHP versions stop receiving security fixes. Your hosting control panel usually lets you switch versions. Test the site after switching, because very old plugins or themes sometimes break on newer PHP, which is itself a sign they need replacing.
Hosting and server
9. Choose a host that takes security seriously
Good hosting does a lot of quiet work for you: server-level firewalls, malware scanning, isolated accounts so one compromised site cannot infect the next, and quick restores. Very cheap shared hosting can cut corners here. I have covered what to look for in my guide on how to choose web hosting for a small business, and my web hosting service includes managed setup if you would rather not handle it yourself.
10. Use HTTPS everywhere
An SSL certificate encrypts data between visitors and your site, including login details and form submissions. Most hosts provide free certificates. Make sure the whole site redirects to the HTTPS version, not just the home page.
11. Use SFTP, not plain FTP
Plain FTP sends passwords unencrypted. If you or your developer upload files directly, use SFTP or the host’s file manager, and remove FTP accounts that are no longer needed.
Backups and monitoring
12. Keep automatic, off-site backups
Backups are your safety net when everything else fails. Back up both files and the database, automatically, and store copies somewhere other than the same server, such as cloud storage. Keep several restore points, not just the latest, because an infection may go unnoticed for days. Most importantly, test a restore occasionally. A backup you have never restored is only a hope.
13. Add a web application firewall and malware scanning
A firewall filters malicious requests before they reach WordPress, and a scanner alerts you to changed core files or known malware. This can come from a security plugin, your host or a service that sits in front of your site. You do not need three overlapping security plugins. One well-configured solution plus good hosting is usually enough, and stacking them can slow the site down.
14. Harden a few WordPress settings
- Disable the built-in theme and plugin file editor in the dashboard, so an attacker with admin access cannot edit code directly.
- Make sure directory browsing is turned off on the server.
- Set sensible file permissions, and ask your host if you are unsure what they should be.
- Protect important configuration files from public access.
These are small changes, but they remove easy footholds. If you are not comfortable editing configuration files, ask your developer or host to do it.
15. Monitor uptime and register with Google Search Console
An uptime monitor emails you if your site goes down. Google Search Console will notify you if Google detects malware or hacked content on your site, which is often how owners first find out. Google’s guide to security issues in Search Console explains what those alerts mean.
If your site has already been hacked
- Do not panic and do not start deleting files at random.
- Contact your host. Many can help identify and clean infections or restore a clean backup.
- Change every password: WordPress users, hosting, database, SFTP and email accounts linked to the site.
- Restore from a clean backup from before the infection, or have the site professionally cleaned.
- Find out how it happened, usually an outdated plugin or a stolen password, and fix that, or it will happen again.
- If Google flagged the site, request a review in Search Console once it is clean.
Frequently Asked Questions
Is WordPress itself insecure?
WordPress core is actively maintained and security issues are patched regularly. Most problems come from outdated plugins and themes, weak passwords and poor hosting, which are all things you can control. Its popularity makes it a frequent target, which is why maintenance matters.
Do I need a paid security plugin?
Not always. Free versions of reputable plugins, combined with good hosting, cover a lot. Paid tiers can add real-time firewall rules and malware cleanup. The right choice depends on how critical the site is and what your host already provides.
How often should I check my WordPress security?
Check for updates weekly, review users and plugins monthly, and test a backup restore every few months. A maintenance plan can handle this for you if you would rather not think about it.
Need help with WordPress security?
I have built and maintained WordPress sites for over 16 years, including more than 500 custom themes, and security is part of every build. If you want a review of your current site or ongoing website development and maintenance, contact me here and I will reply within 24 to 48 hours. You can also read more about how I approach WordPress development.