If you’re working out how to secure a WordPress website, the most effective approach is to layer a few simple protections: lock down logins with strong passwords and two-factor authentication, keep WordPress, plugins, themes and PHP updated, remove anything you don’t use, put a firewall in front of the site, and keep tested off-site backups. Hacked WordPress sites are commonly compromised through weak passwords or outdated plugins, not through some exotic attack on WordPress itself.
This guide turns that into a checklist you can work through in an afternoon, ordered roughly from the highest-impact, lowest-effort steps to the more technical ones.
Start with an honest security audit
Before you change anything, take stock of what you have. You can’t secure what you don’t know about.
- List every user account in Users and note each person’s role. Remove people who no longer need access.
- List every plugin and theme, active and inactive. Note when each was last updated by its developer.
- Check Tools > Site Health for security-related recommendations, such as outdated software or missing HTTPS.
- Find out what your host does: do they run a firewall, malware scanning, automatic backups, isolated accounts?
- Confirm you have a recent, off-site backup before making changes.
Lock down logins and user accounts
Logins are the front door, and they are where most automated attacks aim.
- Use long, unique passwords for every account, generated and stored in a password manager.
- Turn on two-factor authentication (2FA) for all administrators and editors, using a reputable plugin or your host’s or identity provider’s login protection.
- Follow least privilege. Give people the lowest role that lets them do their job. A guest writer needs Author or Contributor, not Administrator.
- Avoid obvious usernames such as “admin” for administrator accounts, and don’t display administrator usernames as author names on public posts.
- Limit login attempts with a security plugin or a firewall rule, so bots can’t guess passwords endlessly.
- Remove shared accounts. Every person should have their own login so you can see who did what and remove access cleanly.
Keep everything updated and trim what you don’t use
Outdated plugins and themes are one of the most common ways attackers get into WordPress sites. Once a vulnerability is published, automated scanners look for sites still running the old version.
- Update WordPress core, plugins and themes promptly. Minor WordPress releases often contain security fixes.
- Enable automatic updates for plugins you trust, or set a weekly update routine with a backup before each round.
- Delete, not just deactivate, plugins and themes you don’t use. Inactive code can still be exploited if it’s on the server.
- Replace plugins that their developers no longer maintain.
- Only install plugins and themes from reputable sources such as the WordPress.org directory or established vendors. Never use “nulled” (pirated) premium plugins; they are a common way malware is distributed.
- Keep PHP on a supported version. Our guide on how to update PHP in WordPress safely walks through the process.
Harden wp-config.php and WordPress settings
A few configuration changes close common gaps. The official WordPress hardening guide covers these in more depth.
Disable the built-in file editor
By default, administrators can edit theme and plugin code from the dashboard. If an attacker gets into an admin account, that editor lets them inject code instantly. Add this line to wp-config.php:
define( 'DISALLOW_FILE_EDIT', true );Use unique security keys
wp-config.php contains security keys and salts used to protect login cookies. Make sure they are set to long, random values, not left as placeholders. If you suspect a breach, changing them logs everyone out.
Other settings worth checking
- Turn off XML-RPC if you don’t use it for apps or remote publishing. It’s a common target for password-guessing attacks.
- Disable directory browsing in your server configuration so visitors can’t list the contents of folders.
- Block PHP execution in the uploads folder, since media folders should only contain images and documents.
- Set sensible file permissions, so files aren’t writable by everyone on the server. Your host can advise on the right settings for its setup.
- Change the database table prefix on new installs. It won’t stop a determined attacker, but it blocks some automated scripts.
Secure the hosting and the connection
WordPress is only as secure as the server it runs on. Good hosting handles a lot of security for you.
- HTTPS everywhere. Install an SSL certificate and redirect all HTTP traffic to HTTPS, so logins and form data are encrypted.
- Account isolation. On shared servers, each site should run under its own user so one compromised site can’t read another’s files.
- SFTP or SSH, not plain FTP. Plain FTP sends passwords unencrypted.
- A web application firewall (WAF). A firewall at the server or a service like Cloudflare can block known attack patterns, bad bots and brute-force attempts before they reach WordPress.
- Strong database credentials, with the database user only allowed to access this site’s database.
- Server software updates. Your host should keep the operating system, web server and PHP patched.
Monitor the site and keep backups ready
No setup is perfect, so you need to notice problems quickly and recover from them.
- Uptime monitoring: get an alert when the site goes down.
- Malware and file-change scanning: a security plugin or host-level scanner can flag modified core files or suspicious new files.
- Activity logging: record logins, plugin installs and settings changes, so you can see what happened during an incident.
- Search Console: Google Search Console notifies you about security issues it detects, such as hacked content.
- Off-site, tested backups: if everything else fails, a clean backup is your fastest route back. Our guide on backing up a WordPress site covers storage and restore testing.
What to do if your site is hacked
If you see unexpected redirects, spam pages, unknown admin users or a warning from your host or Google:
- Put the site into maintenance mode or take it offline if it’s harming visitors.
- Change all passwords: WordPress users, hosting, database, SFTP and email.
- Identify how the attacker got in, usually an outdated plugin or a weak password. Restoring without closing that gap means you’ll be hacked again.
- Restore a clean backup from before the infection, or clean the files with professional help.
- Update everything, change the security keys in wp-config.php, and remove unknown users and files.
- Request a review in Google Search Console if Google flagged the site.
How to secure a WordPress website: a monthly checklist
Run through this list once a month:
- All users still need their access and have the right roles.
- 2FA is on for every admin and editor.
- Core, plugins, themes and PHP are up to date.
- No unused or abandoned plugins or themes remain.
- The file editor is disabled.
- HTTPS works on every page.
- Backups ran successfully and are stored off-site.
- Monitoring alerts are going to an inbox someone reads.
When to get help
Learning how to secure a WordPress website is the easy part; doing the monthly checks without missing anything is harder. If you’d rather hand it over, ongoing WordPress maintenance and security care can cover updates, backups, monitoring and hardening for you, with someone to call if something does go wrong.
FAQ
Do I need a security plugin to secure WordPress?
Not always. Strong passwords, 2FA, timely updates, good hosting and a firewall cover most risks. A security plugin is useful for features such as login limits, scanning and activity logs, especially if your host doesn’t provide them.
How do most WordPress sites get hacked?
Common causes include outdated plugins or themes with known vulnerabilities, weak or reused passwords, and pirated premium plugins that contain malware. Fixing those three areas removes a large share of the everyday risk.
Is WordPress secure enough for a business website?
Yes, when it’s maintained. WordPress has a dedicated security team and ships security fixes in regular releases. The risk usually comes from neglected plugins, weak logins and poor hosting, all of which you can control.
What should I do first if my WordPress site is hacked?
Change all passwords, find and close the entry point, then restore a clean backup or clean the infected files. After that, update everything, change the security keys and request a review in Google Search Console if Google flagged the site.
