Key takeaways
- Outdated plugins are the most common way in, so update everything.
- Use unique admin credentials, 2FA and login-attempt limits.
- Keep backups off the server and test restoring them.
- Delete unused plugins and themes instead of just deactivating them.
Why WordPress gets attacked
WordPress powers a large share of the web, so attackers automate scans for known weaknesses. Most compromises don’t involve exotic zero-days. They come from a handful of basics being skipped: old plugins, weak or reused admin passwords and missing backups.
The checklist
- Update everything. Core, theme and plugins. Enable automatic updates for minor core releases and for plugins you trust, and review the rest weekly.
- Vet plugins before installing. Check recent updates, active installs, reviews and support activity. Fewer, well-maintained plugins beat many abandoned ones.
- Remove, don’t just deactivate. Inactive code can still be exploited, so delete unused plugins and themes.
- Use strong, unique admin credentials. Avoid the username
admin, and see the password security guide. - Enable two-factor authentication for every administrator and editor.
- Limit login attempts and consider moving or protecting the default
/wp-adminlogin, since bots constantly probe it. - Use least privilege. Give people the lowest role they need, and remove accounts that are no longer used.
- Back up off the server. Keep at least one copy somewhere a compromise can’t reach, and test a restore occasionally.
- Serve over HTTPS everywhere and redirect HTTP to HTTPS.
- Lock down files. Add
define('DISALLOW_FILE_EDIT', true);towp-config.phpso a stolen admin session can’t edit PHP from the dashboard, and use restrictive file permissions. - Disable what you don’t use, such as XML-RPC on sites that don’t need it.
- Send security headers such as Content-Security-Policy, X-Frame-Options and X-Content-Type-Options.
Check your headers
The HTTP Header Analyzer on the Tools page helps confirm that a site is sending basic security headers. Test after every hosting or plugin change, because caching and security plugins can alter them.
If you think you’ve been hacked
- Put the site in maintenance mode and change all passwords, including hosting, database and FTP.
- Restore from a clean backup taken before the compromise, then update everything.
- Scan for unknown admin users and modified files, and remove them.
- Find how they got in, usually an outdated plugin, so it doesn’t happen again.
None of this requires a security background. It’s mostly discipline and a repeatable routine.
Frequently asked questions
Do I need a security plugin?
A reputable security plugin can add firewalling, scanning and login protection, but it doesn’t replace updates, backups and strong credentials.
How often should I back up?
Match the frequency to how often content changes: daily for active sites, weekly for rarely-updated ones. Always keep an off-server copy.
Is it safe to use free themes and plugins?
Many are excellent. Download from the official directory or trusted vendors, and avoid nulled (pirated) premium items, which often contain malware.
Should I hide /wp-admin?
Moving or protecting the login reduces bot noise, but it’s obscurity, not security. Strong passwords, 2FA and rate limiting do the real work.
Keep reading
Password Security in 2026: Why Length Beats Complexity
Why long passphrases and unique passwords protect you better than short, symbol-heavy ones, how entropy works, and the habits that stop most account takeovers.
Read article →SQL Injection and XSS, Explained Simply
Two of the most common web vulnerabilities, their shared root cause, short safe-versus-unsafe code examples and the standard fixes.
Read article →Why This Portfolio Is a Static Site (And What That Trade-off Buys)
Plain HTML, CSS and JavaScript on any ordinary web host: what it buys in speed, security and cost, what it costs in convenience, and when to choose something else.
Read article →