WordPress is widely used, which makes it a common target for automated attacks. Most attacks are not personal; they scan for known weaknesses such as outdated plugins and weak passwords. The good news is that a handful of basic practices significantly reduce risk.
This guide covers practical security basics. No setup is perfectly secure, so the goal is to reduce risk and be ready to recover.
Keep Everything Updated
Updates fix security vulnerabilities. Keep these current:
- WordPress core
- Plugins
- Themes
- PHP version on your hosting
Enable automatic updates where appropriate, especially for minor core releases. Back up before major updates and test on staging when possible.
Use Strong Passwords and a Password Manager
Weak and reused passwords are a major risk. Use long, unique passwords for:
- WordPress admin accounts
- Hosting accounts
- Domain registrar accounts
- Database users
- FTP or SFTP accounts
A password manager generates and stores strong passwords.
Enable Two-Factor Authentication
Two-factor authentication adds a second step to logins, such as a code from an authenticator app. Enable it for WordPress admin accounts and for hosting and registrar accounts.
Limit User Accounts and Roles
- Give users the lowest role they need
- Remove accounts that are no longer needed
- Avoid using “admin” as a username
- Review users periodically
Use Trusted Plugins and Themes
- Download from the official directory or reputable developers
- Avoid nulled plugins and themes, which may contain malware
- Remove unused plugins and themes
- Check that plugins are actively maintained
See essential WordPress plugins.
Back Up Regularly
Backups are your safety net. Good backups:
- Run automatically on a schedule
- Include files and databases
- Are stored off-site
- Are kept for a reasonable period
- Are tested by restoring at least once
Choose Secure Hosting
Hosting affects security. Look for:
- Server-level firewalls and malware scanning
- Isolation between sites, especially if you host several. See hosting for multiple websites.
- Up-to-date server software
- Free SSL certificates
- Responsive support
See managed vs. shared hosting.
Use HTTPS
HTTPS encrypts data between visitors and your site. Most hosts provide free SSL certificates. Make sure your site redirects to HTTPS.
Protect the Login Page
- Limit login attempts
- Use two-factor authentication
- Consider a web application firewall
Security Plugins
Security plugins can add firewalls, malware scanning, login protection and activity logs. Choose one well-maintained security plugin rather than several overlapping ones.
File and Database Security
Advanced measures include restricting file editing from the dashboard, setting proper file permissions and using secure database credentials. Many hosts handle some of these at the server level.
Application Passwords and API Access
WordPress supports application passwords for API access. Treat them like passwords: store them securely, give them only to trusted tools and revoke ones you no longer use.
Monitor Your Site
- Watch for unexpected changes, new users or unfamiliar files
- Use uptime monitoring
- Check webmaster tools for security warnings
If Your Site Is Hacked
- Stay calm and document what you see
- Contact your host
- Change all passwords
- Restore from a clean backup if available
- Update everything
- Scan for malware
- Review users and remove unknown accounts
- Request a review in webmaster tools if your site was flagged
Professional cleanup services can help.
Common Mistakes
- Ignoring updates
- Reusing passwords
- Skipping backups
- Using nulled plugins
- Giving too many people admin access
A Monthly Security Routine
- Apply pending updates after a backup
- Review user accounts and remove unneeded ones
- Check security plugin or host scan results
- Confirm backups are running and stored off-site
- Review installed plugins and themes, removing unused ones
- Check webmaster tools for security notices
Security for Teams
When several people manage a site, security depends on everyone:
- Give each person their own account rather than sharing logins
- Use roles that match responsibilities, such as Editor or Author
- Require two-factor authentication for administrators
- Remove access promptly when someone leaves
- Share credentials for hosting and registrars through a password manager
Understanding Common Threats
Common threats include automated login attempts, exploitation of outdated plugins, malicious code from untrusted downloads and phishing emails that trick site owners into revealing passwords. Most of the basics in this guide address these threats directly.
Common Mistakes
- Reusing passwords across sites and services
- Using “admin” as a username
- Delaying updates for months
- Keeping backups only on the same server as the site
- Installing plugins or themes from untrusted sources
- Giving administrator access to everyone
Starting Small
If this feels like a lot, start with three steps: turn on automatic minor updates, set up off-site backups and enable two-factor authentication for administrators. Then add the rest over time.
A Note on Recovery Planning
Write down what you would do if the site were compromised: who to contact at your host, where backups are stored, how to restore them and which passwords to change. Keep this plan somewhere you can reach even if the site and your email are unavailable. A plan written in advance makes a stressful situation much easier to handle calmly.
A Note on Hosting-Level Security
Many hosts provide firewalls, malware scanning, automatic PHP updates and isolated accounts. Check what your host already handles before adding overlapping plugins, since duplicate security tools can conflict, slow the site and create confusing alerts. Ask support which protections are active on your plan and which remain your responsibility.
Frequently Asked Questions
Is WordPress secure?
WordPress core is actively maintained. Most problems come from outdated plugins, weak passwords and poor hosting.
Do I need a security plugin?
Often helpful, though some hosts provide protections.
How often should I back up?
Depends on how often you publish. Many sites back up daily.
What is two-factor authentication?
A second login step, such as an app-generated code.
What should I do if hacked?
Contact your host, change passwords, restore from backup and update everything.
The Bottom Line
Keep WordPress updated, use strong passwords and two-factor authentication, limit users, choose trusted plugins and secure hosting, use HTTPS and back up regularly. Have a recovery plan ready.
Editorial note: Blog Builderly is independent and reader-supported. This guide is based on research into manufacturer documentation, published specifications and widely accepted best practices; we have not been paid to mention any product. If we add affiliate links in the future, they will be clearly disclosed per our Affiliate Disclosure.