Key takeaways
- Most WordPress hacks come from outdated plugins/themes, weak or reused passwords and nulled software — not WordPress core.
- Updates, strong authentication, backups and a firewall prevent the vast majority of attacks.
- Have a recovery plan: off-site backups and a checklist for what to do if you’re hacked.
WordPress powers a huge share of the web, so automated bots constantly scan for weak sites. The good news: you don’t need to be a security expert. These 20 steps, grouped by area, close the doors attackers actually use.
Accounts and logins#
- Strong, unique passwords for every account, stored in a password manager.
- Two-factor authentication (2FA) for all administrators and editors (Wordfence, Solid Security, WP 2FA or your host).
- Least privilege: give people the lowest role they need — authors don’t need admin.
- No “admin” username; remove old accounts of former staff and agencies.
- Limit login attempts and consider CAPTCHA or Cloudflare Turnstile on the login page.
Updates and software#
- Keep WordPress core, themes and plugins updated — enable automatic minor and security updates.
- Remove unused plugins and themes completely (deactivated code can still be exploited).
- Never install nulled themes or plugins — they commonly contain backdoors.
- Use PHP 8.2+ — older versions no longer receive security fixes.
- Prefer well-maintained plugins with recent updates — see essential plugins.
Server and configuration#
- HTTPS everywhere — see SSL & HTTPS.
- Disable file editing in the dashboard: add
define( 'DISALLOW_FILE_EDIT', true );towp-config.php. - Correct file permissions: generally 644 for files, 755 for folders, 600/640 for
wp-config.php. - Hide PHP errors on live sites — see turn off PHP errors.
- Disable XML-RPC if you don’t use the mobile app or Jetpack features that need it.
Need a hand with this?
Get a quick, honest review of your website’s SEO.
Firewall, monitoring and backups#
- Web application firewall: Cloudflare (free plan helps), Wordfence, or your host’s WAF — see Cloudflare setup.
- Malware scanning and file-change alerts.
- Uptime monitoring (UptimeRobot, Better Stack) so you know about problems first.
- Automatic off-site backups with tested restores — see backup guide.
- Activity log to see who changed what (Simple History, WP Activity Log).
Signs your site may be hacked#
- Search results show spam titles (pharma, casino, Japanese characters) for your domain.
- Visitors on mobile are redirected to strange sites.
- Unknown admin users or plugins appear.
- Search Console reports “Security issues” or your host suspends the account.
- Emails from your domain bounce or land in spam suddenly.
If you’re hacked#
- Put the site in maintenance mode and change all passwords (WordPress, hosting, database, SFTP, email).
- Restore a clean backup from before the infection, or have a professional clean the files and database.
- Update everything and remove unknown users, plugins and files.
- Scan again, then request a review in Search Console if Google flagged the site.
- Find the entry point (usually an outdated plugin) so it doesn’t happen again.
WordPress security FAQ#
Is WordPress secure?#
The core is well maintained and patched quickly. Most risk comes from extensions, weak passwords and neglected updates.
Do I need a security plugin?#
A good host plus Cloudflare, 2FA and updates covers a lot. A security plugin adds scanning, login protection and alerts — useful for most business sites.
Should I change the login URL?#
It reduces bot noise but isn’t real protection on its own. 2FA and strong passwords matter much more.