WordPress is the most widely used website platform, which makes it a common target for automated attacks. Most hacked sites are not targeted individually. They are caught by bots that look for outdated plugins, weak passwords and exposed files. The good news is that a few good habits block the large majority of these attacks.
1. Keep everything updated
Update WordPress core, plugins and themes promptly. Outdated plugins are the most common way sites get compromised. Turn on automatic updates for minor releases and for plugins you trust, and test major updates on a staging copy first.
2. Use strong, unique passwords and two-factor login
Every account should have a long, unique password stored in a password manager. Turn on two-factor authentication for administrators and editors. A strong password plus a second factor stops most credential attacks.
3. Use a non-obvious admin username
Avoid “admin” or your brand name as the login. Use a different public display name so the login is not shown on posts or author pages.
4. Limit login attempts
Block repeated failed logins from the same address, and add rate limiting at your firewall or CDN. This slows brute-force attacks to a crawl.
5. Give people the least access they need
Not everyone needs to be an administrator. Give writers the author or editor role, and remove accounts that are no longer used.
6. Remove unused plugins and themes
Deactivated code can still be exploited. Delete what you do not use, and choose plugins that are actively maintained and well reviewed. Fewer plugins also means a faster site.
7. Back up regularly and test the restore
Keep automatic backups stored away from the web server. A backup you have never restored is only a hope. Never leave backup files in a publicly accessible folder, because anyone can download them.
8. Use HTTPS everywhere
Install an SSL certificate, redirect all traffic to HTTPS and consider HTTP Strict Transport Security. This protects logins and form data in transit.
9. Harden WordPress settings
- Disable the built-in theme and plugin file editor with
DISALLOW_FILE_EDIT. - Disable XML-RPC if you do not need it.
- Block PHP execution in the uploads folder.
- Turn off directory listing.
- Hide version numbers where practical.
- Block access to sensitive files such as
readme.htmland backup archives.
10. Add security headers
Headers such as X-Content-Type-Options, X-Frame-Options and Referrer-Policy reduce common browser-based attacks, and they cost nothing in speed.
11. Use a firewall and malware scanning
A web application firewall, whether from your host, Cloudflare or a security plugin, filters known attacks before they reach WordPress. Scan files regularly and set up alerts for changes.
12. Monitor and have a plan
Watch for unexpected admin users, file changes and unusual traffic. Know who to call and what to do if the site is hacked: restore a clean backup, change all passwords and keys, update everything and find how the attacker got in.
How security and speed fit together
A leaner, cleaner site is easier to protect and faster to load. Removing unused plugins, tidying the database and caching help on both fronts. See our WordPress speed checklist for the performance side.
Need help securing your site?
We harden WordPress sites, set up backups and monitor them. See our WordPress maintenance and support service or contact us for a free security review.
