How to secure a WordPress site

Most compromised WordPress sites are not the target of a determined, skilled attacker — they are caught by automated scanning that checks millions of sites for a small number of known weaknesses: an outdated plugin with a published vulnerability, a weak or reused password, or a login form with no limit on attempts. Closing those specific gaps removes the vast majority of real-world risk.

1. Keep everything updated

This matters more than any other single item on this list. Plugin and theme updates frequently patch security vulnerabilities that have just been made public, which means the danger window is narrowest right after an update is released and widest for a site that never updates at all. Automated attacks specifically target sites still running known-vulnerable versions.

See updating WordPress without breaking your site for a routine that keeps this from being risky in itself.

2. Use strong, unique passwords everywhere

Every account with access to the site — every admin, every editor, every database and control panel login — should have its own long, unique password. Reusing a password from another site means a breach anywhere else on the internet can hand someone your WordPress login too.

3. Turn on two-factor authentication

A password alone is a single point of failure. Two-factor authentication requires a second, time-limited code from a phone app on top of the password, which stops a stolen or guessed password from being enough on its own. See turning on two-factor authentication — set it up for every account with admin access, not just your own.

4. Do not use "admin" as a username

It is the first username tried by every automated login attempt, which means using it removes half the work an attacker has to do. If an existing site still uses it, see changing the WordPress admin username.

5. Limit login attempts

WordPress's login form has no built-in limit on how many times a password can be guessed. A plugin or server-level rule that locks out an IP address after a handful of failed attempts turns an automated brute-force attack from a real threat into noise it cannot get past. See limiting WordPress login attempts.

6. Run as few plugins as the site actually needs

Every active plugin is additional code that can contain a vulnerability, and every inactive-but-installed plugin is still a target even while switched off. Audit the plugin list periodically:

• Delete anything not actually in use, rather than leaving it deactivated.
• Prefer plugins that are actively maintained over ones with no recent updates.
• Be cautious with plugins from outside the official WordPress plugin directory or a reputable commercial source, since they get less independent scrutiny.

7. Keep working backups

Security measures reduce the chance of a compromise; they do not make it zero. A current, tested backup is what determines whether a successful attack costs you an afternoon or costs you the site. See backing up a WordPress site, and actually restore one occasionally to confirm it works rather than assuming it does.

8. Use HTTPS everywhere

Every hosting plan here includes free SSL. Beyond the padlock, HTTPS encrypts login credentials and cookies in transit, which matters especially on a site with more than one user logging in from different networks. If any part of the site still loads over plain HTTP, see switching WordPress to HTTPS.

9. Restrict access to sensitive files

Two files are worth specifically protecting from direct access: wp-config.php, which holds your database credentials, and xmlrpc.php, an older WordPress feature that is rarely needed today and is a common target for automated attacks when left open. Your host's default server configuration typically already blocks direct access to wp-config.php; if xmlrpc.php is not required by anything you use — check before disabling it, since some legitimate plugins and the WordPress mobile app can depend on it — it can be blocked in .htaccess.

10. Know the signs of a compromise

Watch for anything unexplained: an admin account you did not create, the site redirecting somewhere else intermittently, unfamiliar files appearing in wp-content, or a sudden drop in search visibility. Catching a problem early keeps the cleanup small. If you find any of these, go straight to cleaning a hacked WordPress site rather than waiting to see if it resolves on its own.

A short version, if you do nothing else

• Update WordPress, plugins and themes promptly.
• Give every account a strong, unique password and two-factor authentication.
• Remove any plugin or theme you are not actively using.
• Keep a tested backup.

None of this makes a site invulnerable — nothing does — but together it removes the specific, well-known weaknesses that automated attacks are actually looking for, which is where the overwhelming majority of real compromises begin.