How to Secure a WordPress Site: 12 Steps That Actually Matter

Most WordPress sites are not hacked by someone targeting them. They are hacked by automated bots that scan millions of sites for the same few weaknesses: an outdated plugin, a weak password, a forgotten file. Close those gaps and you are safer than the large majority of sites. These twelve steps are in the order we would do them.

The basics that stop most attacks

1. Keep everything updated

Outdated plugins are the number one way in. Update WordPress core, plugins and themes every week, and remove any plugin that its developer has abandoned.

2. Delete what you do not use

Inactive plugins and themes are still files on your server and can still be exploited. Delete them.

3. Use strong, unique passwords and two-factor login

Every administrator needs a long unique password and two-factor authentication. One reused password is enough to lose the site.

4. Limit administrator accounts

Give people the lowest role that lets them do their job. Remove accounts for former staff and old freelancers.

5. Take off-site backups

Automatic daily backups stored away from your server are what turn a disaster into an inconvenience. Test a restore at least once.

Hardening the site

6. Never use nulled plugins or themes

Pirated premium plugins are a common source of backdoors. If you need a premium plugin, buy it.

7. Limit login attempts

Block repeated failed logins so bots cannot guess passwords all day.

8. Disable XML-RPC if you do not need it

It is an old interface that is mainly used today for brute-force attacks.

9. Turn off file editing in the dashboard

The built-in theme and plugin editor lets anyone who gets into an admin account change code. Switch it off in your configuration.

10. Use a firewall and malware scanner

A security plugin or a service in front of your site blocks known attack patterns and warns you when files change.

The parts people forget

11. Look after your hosting account

Use a strong password and two-factor login on the hosting panel too. If several sites share one hosting account, an infection on one can spread to the others, so every site on the account has to be kept clean and updated, including old test sites.

12. Remove leftover files

Old backups, installer scripts, database dumps and file manager tools left in the site folder are an open door. Delete them once you are done.

Signs your site may already be hacked

• Visitors are redirected to other websites.
• Google shows strange titles, foreign-language text or a security warning for your site.
• Admin users appear that you did not create.
• Unknown files show up, especially PHP files in the uploads folder.
• Your host suspends the account or reports malware.
• Analytics shows visits to pages that do not exist on your site.

If you see any of these, read our guide on what to do when a WordPress site is hacked and act quickly.

Prevention is cheaper than cleanup

All twelve steps together take a few hours. A cleanup takes far longer, and the damage to search rankings and customer trust can last for months.

If you would rather have it done for you, or you suspect a problem already, our WordPress malware removal service covers both cleanup and hardening. You can also book a free call.