WordPress powers a huge share of the web, which also makes it a huge target. The reassuring part: almost all WordPress hacks exploit the same few weaknesses - weak logins, outdated code and abandoned plugins. Close those and you've shut the door on most attacks. Here is a practical, no-nonsense WordPress security checklist.
Quick answer
To secure a WordPress site, keep WordPress core, themes and plugins updated and delete anything you do not use; give every admin account a strong, unique password and two-factor authentication; limit login attempts; serve the whole site over HTTPS; take automatic off-site backups; and put a web application firewall or Layer 7 protection in front of it. Most hacked WordPress sites were running an outdated plugin.
Lock down logins first
Brute-force login attempts are the most common attack of all. Three things stop them cold:
- Never use "admin" as your username - attackers try it first.
- Use a long, unique password and a password manager. This one change blocks most brute-force attacks.
- Turn on two-factor authentication (2FA) with a plugin, so a stolen password alone isn't enough.
A login-limiter plugin that locks out repeated failed attempts adds another strong layer.
Keep everything updated
The second most common way in is outdated software. When a vulnerability is found in a plugin or theme, attackers scan the whole internet for sites still running the old version. Keep WordPress core, your theme and every plugin current - enable auto-updates for security releases where you can. An out-of-date plugin is an open window.
Fewer plugins, from trusted sources
Every plugin is code running on your site, and abandoned plugins never get security fixes. Install only what you need, from reputable developers, and delete (don't just deactivate) anything you're not using. Before installing, check when a plugin was last updated - one untouched for two years is a risk.
Lock down file permissions and wp-config.php
Beyond logins and plugins, the files themselves need the right permissions - directories writable where WordPress genuinely needs it, not wide open by default. Your wp-config.php file holds the database credentials and secret keys, so keep it out of reach of anything that shouldn't read it, and rotate the secret keys if you ever suspect a compromise. If a permissions change ever locks you out of a file WordPress needs, 403 forbidden error covers the usual cause.
Force HTTPS with SSL
SSL encrypts the traffic between your visitors and your site, protecting logins and data in transit. Free certificates from Let's Encrypt make this a one-click job - there's no excuse to run on plain HTTP in 2026. If you see a certificate warning, see fixing "Not Secure" / expired SSL.
Back up - and test the restore
Backups are what turn a disaster into an inconvenience. Take automatic, off-site backups of both files and database, and - the part people skip - actually test a restore once, so you know it works before you need it. A backup you've never restored is a guess.
Recognising a hacked site - and what to do next
Common signs of a compromised WordPress site include a sudden white screen of death, unfamiliar admin users, spam content or redirects injected into pages, and a "database connection" error that appears out of nowhere - see error establishing a database connection. If you see these, restore from a clean backup rather than trying to hand-clean an infected site, and change every password and API key that touched it, exactly as you would for any compromised server.
Do you need a security plugin?
A reputable security plugin (Wordfence, Sucuri and similar) adds firewalling, malware scanning and login protection in one place, and is worth running on most sites - but it is not a substitute for updates and strong logins, only a second layer on top of them. Pick one, configure its scanning schedule, and actually read the alerts it sends you.
Let your host block attacks
A lot of security happens before traffic reaches WordPress. A good host gives you a firewall, isolation from other accounts, and DDoS protection so a flood can't knock your site offline in the first place. This is one of the biggest reasons the host you choose matters as much as what you do in wp-admin - see how to choose a web host.
You don't need to be paranoid - you need to be current. Strong logins, updates, fewer plugins, SSL and backups stop the overwhelming majority of WordPress hacks.
Running WordPress on a VPS instead of shared hosting? Layer on the server-side basics too: see the Linux VPS hardening checklist.