Guide
How to secure a WordPress website: 15 practical steps
The most effective WordPress security steps are to update everything promptly, use strong unique passwords with two-factor login, remove unused plugins and themes, and keep tested backups. Your hosting adds a firewall, malware scanning and account isolation. Together they stop the great majority of attacks on small business sites.
Layers
Where security happens
- ServerFirewall, DDoS protection, isolation
- ScannerImunify360 looks for malware
- WordPressUpdates, settings and users
- Plugins and themesThe most common weak point
- YouPasswords and habits
The reality
How WordPress sites actually get hacked
WordPress powers a very large part of the web, so attackers target it with automated tools. Most attacks are not aimed at a particular business. They scan for known weaknesses, usually in outdated plugins and themes, and for weak or reused passwords.
That is good news, because the same tools find nothing if the site is up to date and well configured. Most successful hacks exploit a hole that had a fix available for weeks or months. Staying current is the single most effective thing you can do.
The rest of this guide covers fifteen steps, grouped into updates, access, plugins, hardening and recovery.
Updates
Steps 1 to 3: keep everything current
- 1. Update WordPress core. Turn on automatic minor updates and apply major ones after a backup.
- 2. Update plugins and themes. Check weekly, and apply security updates quickly.
- 3. Keep PHP supported. Use a current PHP version, chosen in the control panel.
Access
Steps 4 to 7: control who gets in
- 4. Use strong, unique passwords. A password manager makes this painless.
- 5. Turn on two-factor login. It blocks most stolen-password attacks.
- 6. Limit administrators. Give people the lowest role they need.
- 7. Do not use "admin" as a username. Create a different administrator and remove the default.
Worked example
A tidy-up of a neglected small business site
A plumber has a WordPress site built three years ago. It has fourteen plugins, six of them unused, two themes that are never activated and a user list that still includes the original web designer. WordPress core is two major versions behind.
He starts by taking a backup. Then he deletes the unused plugins and themes, because inactive code can still be exploited. He updates the remaining plugins and WordPress itself, testing the site after each step. He removes the designer's account, gives himself a new long password and turns on two-factor login. Finally he changes the login to a limited number of attempts.
The whole job takes about an hour. The site has far less code to attack, everything left is current, and the only accounts are ones he recognises. Nothing about the site looks different to visitors, which is how good security should feel.
Priorities
What to fix first, by effort and benefit
| Action | Effort | Benefit |
|---|---|---|
| Update WordPress, plugins and themes | Low | Closes known holes attackers scan for |
| Delete unused plugins and themes | Low | Shrinks the attack surface |
| Strong unique passwords and two-factor login | Low | Stops most account takeovers |
| Remove old user accounts | Low | Removes forgotten doors |
| Regular off-server backups | Medium | Turns a disaster into an inconvenience |
| Limit login attempts | Low | Slows automated password guessing |
| Review user roles | Low | Keeps powers to the people who need them |
Warning signs
How to tell if a site may already be compromised
A hacked site does not always look hacked. Typical signs are pages or links you did not create, visitors being redirected to strange sites, search results showing odd titles for your pages, a sudden drop in traffic, a warning from the browser or a message from your host about unusual activity. New administrator accounts you did not make are a particularly strong signal.
If you suspect a problem, do not panic and do not delete everything. Take a backup of the current state for evidence, change every password, update everything and run a malware scan. Our hosting includes Imunify360 and a ModSecurity firewall, and our live chat is open 24/7 if you want a second pair of eyes. Restoring a clean backup from before the problem is often the fastest cure, followed by closing the hole that let the attacker in.
Common mistakes
Habits that quietly weaken a site
Using nulled or pirated themes and plugins is the worst one. They are very commonly packed with hidden malware. Buy from the official directory or the developer, or do without. Another is reusing a password across sites, so one leaked password from an unrelated service opens your dashboard.
Many owners also leave the default "admin" username, give every helper full administrator rights and postpone updates for months because something might break. Updating promptly, with a backup taken first, is far safer than running old code. Finally, security plugins do not replace a good host: use both layers rather than relying on either alone.
- Never install nulled or cracked plugins
- Use a different password on every site
- Give people the lowest role that lets them do their job
- Do not leave the username as admin
- Update promptly, with a backup first
- Delete, do not just deactivate, what you do not use
Routine
A monthly fifteen minute check
Security is mostly routine. Once a month, log in, take a backup, apply updates, scan the user list for accounts you do not recognise and look at your host or security plugin report. Fifteen minutes is enough, and it catches nearly everything that matters before it becomes a problem. Put it in your calendar, because a good intention without a date rarely survives a busy month.
Security on the server, included
Imunify360, a firewall and DDoS protection on every plan.
Plugins and themes
Steps 8 to 10: choose carefully
- 8. Install only what you need. Every plugin is more code to keep safe.
- 9. Use trusted sources. Download from the official directory or the developer, never from pirate sites.
- 10. Delete what you do not use. A disabled plugin can still be attacked.
Hardening and recovery
Steps 11 to 15: harden and prepare
- 11. Use HTTPS everywhere. Free SSL is included on every plan.
- 12. Limit login attempts. A plugin or the firewall can slow brute-force attempts.
- 13. Keep backups and test them. See our backup guide.
- 14. Watch for changes. Review users and file changes regularly.
- 15. Have a recovery plan. Know who to call and how to restore.
Plugins
Choosing plugins that are safe to depend on
Before installing a plugin, check when it was last updated, how many active installations it has, how the developer responds to support questions and whether the reviews mention security problems. A plugin that has not been updated for a year or more is a risk, even if it still works.
Prefer plugins that do one thing well over big all-in-one packages that you only use a tenth of. And never install "nulled" versions of paid plugins or themes. They are a very common way for malware to get onto a site, since the person who removed the licence check can add anything.
Warning signs
Signs of a compromised site and what to do
| Sign | Likely meaning | First action |
|---|---|---|
| Strange pages or links in search results | Injected spam content | Contact us, restore a clean backup |
| Visitors redirected elsewhere | Malicious code in files or the database | Scan, clean and update |
| Unknown admin users | An attacker created an account | Remove it and reset all passwords |
| Hosting warns of malware | The scanner found a threat | Follow the instructions, restore and update |
| Site very slow or unreachable | Attack or compromise | Contact live chat promptly |
If it happens
What to do if your WordPress site is hacked
Act calmly and in order. First change every password: hosting, WordPress admin, database and email. Then contact our live chat, who can check the account and point you to a clean backup from before the problem.
Restore that backup, update WordPress, plugins and themes, and remove anything unused. Find out how the attacker got in, because restoring without fixing the cause invites a repeat. Finally, check your Google Search Console for security warnings and request a review if you have one.
If customer data may have been exposed, UK data protection rules can require you to tell the Information Commissioner's Office and affected people. Take advice if you are not sure.
FAQ
Common questions
Is WordPress secure?
The core software is well maintained. Most problems come from outdated plugins, weak passwords and poor habits.
Do I need a security plugin?
A good one can help with login protection and scanning. Your hosting already provides a firewall and malware scanning, so avoid piling on overlapping tools.
How often should I update?
Check weekly, and apply security updates as soon as you can after a backup.
Does your hosting protect WordPress?
Yes. Imunify360, a firewall, DDoS protection and CloudLinux isolation are included on every plan.
What if I get hacked?
Change passwords, contact our live chat and restore a clean backup. See the steps above.
Keep reading
Related pages
Host WordPress with security built in
Imunify360, a firewall and free SSL on every plan.