13 steps to a secure WordPress website

WordPress powers around 43% of the web, which makes it the single biggest target for automated attacks. The good news: the overwhelming majority of hacked WordPress sites are compromised through a handful of avoidable weaknesses. Work through these steps and you close the doors that attackers actually use. This is the practical, plain-English checklist I apply to every site I look after.

Step 1: Keep everything updated

Outdated plugins, themes and WordPress core are the number one cause of hacked sites. Updates routinely patch known security holes, and the moment a vulnerability is public, bots start scanning for sites that have not patched it.

• Update WordPress core, plugins and themes promptly, ideally weekly.
• Test updates on a staging copy first if your site is business-critical.
• Remove any plugin or theme you are not using, deactivated is not enough, delete it.
• Only install plugins from reputable sources with recent updates and good reviews.

Step 2: Use strong logins and limit attempts

Brute-force attacks, bots guessing username and password combinations, are relentless and automated. Make them pointless.

• Never use "admin" as a username, create a unique admin name.
• Use long, unique passwords (a password manager makes this painless).
• Enable two-factor authentication (2FA) on all admin accounts.
• Limit login attempts so bots get locked out after a few tries.
• Consider changing the default /wp-admin login URL to reduce automated attacks.

Step 3: Install a security plugin

A reputable security plugin adds a firewall, malware scanning and login protection in one place. The well-regarded options include Wordfence, Sucuri and iThemes Security. Configure the firewall, enable scanning, and set up alerts so you hear about problems early.

Step 4: Back up properly (and test it)

Backups are your safety net. If the worst happens, a recent, working backup turns a catastrophe into an inconvenience. The key word is working, an untested backup is just a hope.

• Automate daily backups (more often for busy ecommerce sites).
• Store backups off-site, not just on the same server as your site.
• Keep several restore points, not just the latest.
• Actually test a restore periodically, so you know it works before you need it.

Step 5: Lock down the foundations

• Force HTTPS with a valid SSL certificate across the whole site.
• Use the correct file and folder permissions (typically 644 for files, 755 for folders).
• Disable file editing from the WordPress dashboard.
• Change the default "wp_" database table prefix on new installs.
• Keep your PHP version current, old PHP is both slow and insecure.
• Choose quality hosting, cheap shared hosting is a common weak point.

Step 6: Manage users and permissions

Every account is a potential way in. Give people the lowest level of access they need to do their job, an editor does not need administrator rights, and remove accounts the moment someone no longer needs them.

Step 7: Monitor, and have a recovery plan

Security is not a one-off task, it is ongoing. Set up uptime and malware monitoring so you know immediately if something changes, and know in advance how you would recover: who to call, where the backups are, and how to take the site into maintenance mode while you fix it.

What should you do if your WordPress site has been hacked?

Take the site offline immediately if possible, restore from your most recent clean backup, change every password (WordPress, hosting, database, email), scan for remaining malware with a security plugin, and notify your host.

• Do not panic, and do not just delete things blindly.
• Take the site into maintenance mode to protect visitors.
• Restore from a known-clean backup if you have one.
• Scan and clean with a security plugin, or get professional help, to remove the infection.
• Find and patch the entry point (usually an outdated plugin) so it does not recur.
• Change all passwords and re-secure every account.
• Request a review in Google Search Console once clean to clear any warning.

How do WordPress sites actually get hacked?

The overwhelming majority of hacks exploit known vulnerabilities in outdated plugins, themes or WordPress core " not targeted attacks on individual sites. Automated bots scan millions of sites for these vulnerabilities continuously.

Understanding the common attack routes makes the whole checklist make sense. Almost every compromise comes through one of these doors, and every step in this guide closes one.

Which WordPress security tools are worth using?

Wordfence and Solid Security (iThemes Security) are the most widely recommended security plugins. Cloudflare's free plan adds a useful firewall and DDoS protection at the DNS level. Use at least one.

You do not need a dozen tools, you need the right few, configured properly.

• A security plugin (Wordfence, Sucuri or iThemes Security) for firewall, scanning and login protection.
• A reputable backup solution (UpdraftPlus, BlogVault) sending copies off-site.
• Two-factor authentication on every admin account.
• Uptime and malware monitoring so you hear about issues immediately.
• An SSL certificate (free via Let's Encrypt) forcing HTTPS everywhere.

What should your monthly WordPress security routine include?

Each month: confirm all plugins, themes and WordPress core are updated, check backup logs to confirm backups are running, review security plugin logs for anything unusual, and confirm your SSL certificate is valid.

Security is a habit, not a one-off. A short monthly routine keeps you safe with minimal effort.

• Apply all pending core, plugin and theme updates (after a backup).
• Confirm your latest backup ran and is stored off-site.
• Run a malware scan and review any security alerts.
• Check user accounts and remove any no longer needed.
• Glance at uptime and performance for anything unusual.

Building this into a recurring monthly reminder is the simplest way to stay on top of it. The routine matters more than the tools, a little regular attention prevents almost every serious problem.

Frequently asked questions

Do I really need a security plugin if my site is small?

Yes. Attacks are automated and indiscriminate, bots do not care how small you are. A small business site is just as likely to be probed as a big one, and often less well protected.

How often do WordPress sites actually get hacked?

Constantly, at the attempt level, every WordPress site is probed daily. The ones that get compromised are almost always the ones running outdated software or weak logins. Keep those tight and you avoid the vast majority of incidents.

Can a care plan handle all of this for me?

Yes. A managed maintenance plan typically covers updates, backups, monitoring, hardening and recovery, which is why many businesses choose to have security handled in the background rather than manage it themselves.

Keep reading

• →Website Care Plans, updates, backups, security and monitoring from £85/month
• →Why Backing Up WordPress Matters, your safety net, explained
• →Why Fast Websites Win More Customers, speed, security and performance go together
• →WordPress Website Design, sites built secure and fast from day one
• →Website QA Testing, a pre-launch check that includes security