WordPress powers a large share of the web, which also makes it a popular target for automated attacks. Most break-ins do not come from clever, targeted hacking. They come from outdated plugins, weak passwords and forgotten admin accounts. The good news is that a handful of steady habits closes most of those doors. This guide walks through the basics every site owner and developer should have in place.
Keep Core, Themes and Plugins Updated
Updates are the most effective security measure you have. Many WordPress releases and plugin updates fix known vulnerabilities, and once a fix is public, attackers know exactly what to look for on sites that have not updated yet. Minor core releases update automatically on most installs, but plugins and themes often need your attention.
Check for updates at least once a week. For busy or business-critical sites, test updates on a staging copy first so a conflict does not take the live site down. If you are not sure how to set one up, our guide to WordPress development setup covers local and staging environments. Also remove plugins and themes you no longer use. A deactivated plugin still sits on the server, and its files can still be reached.
Protect the Login
The login page is in the same place on every WordPress site, so bots try common usernames and passwords on it all day. Start with the obvious: never use “admin” as a username, and give every account a long, unique password stored in a password manager. Beyond that, consider these steps:
- Two-factor authentication for every administrator and editor account.
- Limiting login attempts, either through a security plugin or at the server or firewall level.
- Giving people the lowest role they need. A writer rarely needs to be an administrator.
Review the user list now and then and delete accounts that belong to former staff, freelancers or old test logins.
Choose Plugins and Themes Carefully
Every plugin adds code that runs on your site, so it pays to be selective. Before installing one, look at when it was last updated, whether the developer answers support questions and whether it is tested with your WordPress version. Prefer well-maintained plugins from the official directory or established developers over random downloads.
Avoid “nulled” premium themes and plugins offered for free on unofficial sites. They are a common way to slip malware onto a site, and they never receive security updates. If a plugin does only one small thing, ask whether a few lines of custom code would do the job instead.
Back Up and Plan for Recovery
No setup is perfectly secure, so plan for the day something goes wrong. A good backup routine saves both the database and the wp-content folder, runs automatically and keeps copies somewhere other than the web server itself. Daily backups suit most active sites, while a site that rarely changes can get by with less.
A backup you have never restored is only a hope. Every few months, restore one to a staging site and confirm that it works. Write down where backups are stored and who can access them, so recovery does not depend on one person’s memory.
Harden the Server and Configuration
A few configuration changes make life harder for attackers:
- Use HTTPS across the whole site.
- Disable file editing in the dashboard by adding
define( 'DISALLOW_FILE_EDIT', true );to wp-config.php. - Set sensible file permissions, typically 755 for folders and 644 for files, and restrict access to wp-config.php.
- Run a PHP version that still receives security support. Most hosts let you switch versions from their control panel.
Your host plays a big role here too. Server-level firewalls, malware scanning and isolated accounts do a lot of work that no plugin can. If you are comparing providers, read our overview of WordPress hosting.
Security is not a one-time task. Set a recurring reminder to update, review users and test a backup, and you remove the openings that most automated attacks rely on. If something does look wrong, such as unknown admin users or strange redirects, act quickly: change passwords, restore a clean backup and find out how the attacker got in before you go back to business as usual.