If you run a WordPress website, security cannot be an afterthought.
A hacked site can mean lost traffic, damaged rankings, malware warnings in search results, broken contact forms, stolen admin accounts and angry customers. For small businesses, bloggers, agencies and online shops, even a short outage can cost money and trust.
The good news is that WordPress security does not need to be complicated. Most successful attacks happen because of simple weaknesses such as outdated plugins, weak passwords, poor hosting hygiene, missing backups or unprotected login pages. Fix those first and you reduce a huge amount of risk.
In this guide, you will learn how to secure your WordPress site properly, from the basics to the extra hardening steps that matter once your traffic starts growing.
Why WordPress Security Matters
WordPress core is actively maintained by a dedicated security team, and the platform continues to receive security releases when needed. The bigger risk is usually not WordPress itself, but the surrounding stack: themes, plugins, admin habits, hosting setup and weak access controls. WordPress has also made clear that very old branches should not be relied on for ongoing protection, and current versions should be kept up to date.
That means a secure WordPress site is really about layers:
- secure hosting
- secure logins
- secure updates
- secure plugins and themes
- secure backups
- secure monitoring
- secure recovery planning
The Fastest WordPress Security Wins
If you do nothing else today, do these first:
- Update WordPress core, plugins and themes.
- Delete unused plugins and themes.
- Use strong unique passwords for every admin account.
- Turn on multifactor authentication.
- Limit who has administrator access.
- Set up automated off-site backups.
- Add a firewall or security layer.
- Use HTTPS everywhere.
- Change hosting if your current provider is poor on security.
- Monitor your site for file changes, failed logins and malware.
That alone puts you ahead of a surprising number of sites.
1. Keep WordPress Core, Plugins and Themes Updated
This is the most important step.
Security fixes are useless if you do not install them. WordPress continues to publish security releases, and plugin developers do the same. The longer you delay updates, the longer attackers have to target known weaknesses.
What to do
- Update WordPress core as soon as stable releases are available.
- Update plugins and themes regularly.
- Remove anything abandoned or rarely maintained.
- Avoid nulled themes or plugins completely.
- Test updates on a staging copy first if the site is important.
Best practice
Use fewer plugins, not more. Every extra plugin is another component to maintain and another possible attack surface.
2. Use Strong Passwords and Multifactor Authentication
Weak credentials are still one of the easiest ways into a site. WordPress guidance recommends strong passwords, and CISA recommends MFA because it makes stolen passwords far less useful to attackers.
What to do
- Use long, unique passwords for every admin, editor and hosting account.
- Store passwords in a proper password manager.
- Enable MFA on WordPress admin logins.
- Enable MFA on your hosting panel, domain registrar and email accounts too.
Why this matters
A secure WordPress password is not enough if your email account is weak. Email often controls password resets, so it is part of your site security whether you think about it or not.
3. Remove Unused Plugins, Themes and Admin Users
A plugin you are not using is not harmless. It is just another thing that can go out of date.
The same goes for themes. Keep your active theme and a current default theme if needed for troubleshooting, but remove old unused ones. Audit user accounts too. Former staff, old contractors and forgotten admin logins are classic problems.
What to do
- Delete deactivated plugins you do not need.
- Delete unused themes.
- Remove old admin users.
- Give people the lowest role they actually need.
- Avoid using the same admin account across multiple people.
4. Secure Your Login Page
Your login page is a constant target for bots.
Attackers will hammer /wp-login.php and /wp-admin/ with common usernames and leaked passwords. WordPress documents brute-force risk directly, so protecting logins is essential.
Practical protections
- Use MFA.
- Limit login attempts.
- Block known bad IPs if needed.
- Use bot protection or a web application firewall.
- Hide or reduce username exposure where sensible.
- Use a non-admin username for daily logins.
Important note
Changing the login URL can reduce noise from basic bots, but it is not real security on its own. Treat it as a minor deterrent, not a primary defence.
5. Use HTTPS Everywhere
Every WordPress site should be fully on HTTPS.
Without HTTPS, logins, session cookies, form submissions and customer data are at greater risk. It also creates trust and SEO issues. OWASP continues to stress testing for credentials over encrypted channels as a core security concern.
Check this carefully
- Your site loads on HTTPS without warnings.
- WordPress Address and Site Address use https://.
- Internal assets are not causing mixed-content errors.
- Admin logins and forms always use TLS.
6. Choose Hosting That Does Not Fight You
A lot of WordPress security starts before WordPress loads.
If your hosting is slow, outdated, badly isolated or missing basic protections, you are making life harder for yourself. You want a host that supports current PHP versions, modern databases, SSL, backups, malware handling and sensible account isolation.
Hosting features worth having
- current PHP support
- server-side malware scanning
- WAF or upstream filtering
- daily backups
- staging environments
- strong account isolation
- DDoS protection
- clear patching policies
Cheap hosting can be fine for a small site, but insecure cheap hosting is expensive once something goes wrong.
7. Back Up Properly and Test the Restore
A backup is only useful if it restores cleanly.
This is where many site owners fail. They install a backup plugin, assume everything is fine, and never verify the backup actually works.
Follow this rule
Keep:
- regular automated backups
- off-site backups
- multiple restore points
- a tested restore process
Minimum backup plan
- Daily backup for database-driven sites
- More frequent backups for shops or busy membership sites
- Weekly or monthly archival copies kept separately
If your site is hacked, backups can turn a disaster into an inconvenience.
8. Install a Firewall or Security Layer
A firewall helps filter malicious traffic before it becomes a bigger problem.
This can be done at plugin level, host level or through a cloud security layer. The best choice depends on your budget, traffic and technical confidence, but some form of request filtering is a smart move for most sites.
Firewall benefits
- blocks common malicious requests
- reduces brute-force attacks
- helps stop known exploit patterns
- cuts bot noise
- may improve visibility into attack traffic
For higher-traffic sites, an external firewall or CDN-based layer is often better than relying only on a plugin.
9. Scan for Malware and Suspicious Changes
Security is not just prevention. It is detection too.
A compromise can sit unnoticed for days or weeks if you are not checking for file changes, malicious redirects, spam pages or unusual admin activity.
Watch for
- unknown admin accounts
- strange scheduled tasks
- modified core files
- injected spam content
- unexpected redirects
- SEO spam pages
- email delivery problems
- sudden traffic drops
- browser malware warnings
Good habits
- Run regular malware scans
- Monitor file integrity
- Check Search Console for security issues
- Review server logs when something looks off
10. Lock Down File Permissions
Poor file permissions can make a bad situation much worse.
You want WordPress to work normally without letting every process write everywhere. Exact settings can vary by hosting setup, but the principle stays the same: only grant the permissions your stack actually needs.
General rule
- files should not be writable by everyone
- directories should not be overly permissive
- wp-config.php deserves extra care
- disable direct editing in the dashboard if you do not use it
For example, adding this to wp-config.php is a sensible hardening step:
define('DISALLOW_FILE_EDIT', true);
That stops theme and plugin file editing from the admin area, which removes one common post-compromise abuse path.
11. Protect wp-config.php and Sensitive Areas
Your wp-config.php file contains some of the most important settings in your site, including database details and security keys.
Priorities
- keep it out of public exposure
- deny direct web access where appropriate
- use strong unique authentication salts
- never leave development credentials in production
If your host allows it, you can also use server rules to block access to sensitive files and directories.
12. Use Security Headers and Server Hardening
WordPress security is not just about the application layer. Server hardening matters too.
A modern setup should include sensible headers, secure PHP configuration, updated packages, limited exposed services and no unnecessary admin tools left open to the internet. OWASP’s broader testing and risk guidance remains relevant here because WordPress still sits inside a normal web application environment with familiar attack classes.
Useful hardening areas
- keep PHP updated
- disable unused PHP functions where appropriate
- hide unnecessary version exposure
- add security headers
- restrict XML-RPC if you do not need it
- protect admin and database panels
- review cron jobs and scheduled tasks
13. Be Careful With Plugins That Promise Everything
Security problems often begin with convenience.
A plugin with poor maintenance, vague documentation, weak reviews or too many permissions can turn into a serious risk. Fewer high-quality plugins are usually better than lots of average ones.
Before installing a plugin
Ask:
- Is it actively maintained?
- Does it have recent updates?
- Does it have a solid reputation?
- Does it really need the permissions it asks for?
- Could I solve this another way?
14. Lock Down User Roles and Admin Habits
People are part of security.
Not every staff member needs admin access. Not every freelancer should keep permanent access. Not every content editor should be able to install plugins.
Good access control
- one admin account per real person
- no shared admin logins
- lowest necessary role
- remove access when work ends
- review access regularly
This helps with both security and accountability.
15. Secure Your Email and Domain Registrar Too
A site can be taken over without a direct WordPress exploit.
If someone gains access to your email, they may reset passwords. If they gain access to your domain registrar, they may redirect your traffic. These accounts are critical infrastructure for your site.
Secure them by default
- strong unique passwords
- MFA enabled
- limited account sharing
- alerts for login attempts
- up-to-date recovery options
16. Have a WordPress Incident Response Plan
Do not wait until the site is hacked to decide what to do.
Your plan should include
- who has access to hosting, DNS and backups
- how to put the site into maintenance mode
- how to restore from a clean backup
- how to change all passwords and salts
- how to scan for persistence
- how to notify customers if needed
- how to request blacklist review if search engines flag the site
A calm checklist beats panic every time.
A Simple WordPress Security Checklist
Use this as your baseline:
- WordPress core updated
- plugins updated
- themes updated
- unused plugins deleted
- unused themes deleted
- strong passwords enforced
- MFA enabled
- admin roles reviewed
- backups automated
- backups tested
- HTTPS enforced
- firewall enabled
- malware scans running
- file permissions reviewed
- file editing disabled
- hosting account secured
- domain registrar secured
- email account secured
- incident response plan documented
Common WordPress Security Mistakes
These are the errors that keep showing up:
Leaving old plugins installed
Deactivated is not the same as safe.
Using one password everywhere
A breach elsewhere can become your WordPress breach.
Skipping updates because the site is busy
That is exactly when a site matters most.
Having too many administrators
More admin accounts means more risk.
Assuming backups are enough
Backups without testing are wishful thinking.
Trusting poor-quality plugins
Not every plugin is worth the convenience.
Forgetting the rest of the stack
Hosting, email, DNS and devices all matter.
Final Thoughts
The best WordPress security strategy is not one big trick. It is lots of small sensible choices done consistently.
Keep everything updated. Reduce unnecessary plugins. Use strong passwords. Turn on MFA. Back up properly. Add a firewall. Watch for strange changes. Secure your hosting, email and domain accounts as seriously as you secure WordPress itself.
If you do those things well, your site becomes a much harder target.
And in security, that matters.
FAQ
Is WordPress secure enough for a business website?
Yes, when it is maintained properly. The real risks usually come from weak admin practices, outdated plugins, poor hosting and missing security controls rather than WordPress core alone.
What is the most important WordPress security step?
Keeping core, plugins and themes updated is one of the biggest wins, closely followed by strong passwords, MFA and reliable backups.
Do I need a WordPress security plugin?
Not always, but most site owners benefit from either a strong security plugin, a host-level security layer, or an external firewall.
Is changing the login URL enough to protect WordPress?
No. It may reduce low-quality bot traffic, but it should never replace proper login protection such as MFA, strong passwords and rate limiting.
Should I delete inactive plugins?
Yes. If you are not using them, remove them.