How to Secure a WordPress Site — 18-Point Guide
90 percent of WordPress hacks come from outdated software, weak passwords, or vulnerable plugins. This 18-point checklist covers what matters most, starting with updates, 2FA, and a security plugin.
90 percent of WordPress hacks come from outdated software, weak passwords, or vulnerable plugins. This 18-point checklist covers what matters most, starting with updates, 2FA, and a security plugin. Implement these steps and you eliminate the vast majority of attack vectors.
Why WordPress gets hacked
WordPress powers over 40 percent of the web, which makes it a massive target for automated attacks. The attacks are not targeted at your specific site; they are bots scanning the entire internet for known vulnerabilities. If your site has an outdated plugin, a default admin username, or a weak password, the bots will find it.
Three causes account for the vast majority of successful WordPress hacks. Outdated software leads the list, as attackers exploit publicised vulnerabilities in old versions of plugins and themes. Weak passwords come second, especially for administrator accounts. Vulnerable plugins rank third, either from poorly coded free plugins or from nulled premium plugins that contain backdoors. Understanding these patterns is the first step to learning how to secure a WordPress site effectively.
The good news is that these three causes are entirely preventable. None of them require advanced technical skills. They require discipline, good habits, and a hosting provider that handles the server-level security layer.
18-point security checklist
| # | Action | Priority | Difficulty |
|---|---|---|---|
| 1 | Keep WordPress core, themes and plugins updated | Critical | Easy |
| 2 | Use strong unique passwords for all accounts | Critical | Easy |
| 3 | Enable two-factor authentication (2FA) for admin users | Critical | Easy |
| 4 | Install a security plugin (Wordfence, Sucuri, Solid Security) | Critical | Easy |
| 5 | Change the default wp_ database prefix | High | Medium |
| 6 | Remove unused themes and plugins | High | Easy |
| 7 | Limit login attempts | High | Easy |
| 8 | Disable PHP file execution in wp-content/uploads | High | Medium |
| 9 | Set correct file permissions (755 dirs, 644 files) | High | Medium |
| 10 | Use HTTPS with a valid SSL certificate | High | Easy |
| 11 | Change the admin username from “admin” | Medium | Easy |
| 12 | Hide the WordPress version number | Medium | Easy |
| 13 | Disable XML-RPC or restrict it to authorised IPs | Medium | Medium |
| 14 | Set up automated daily backups with offsite storage | Medium | Easy |
| 15 | Implement a Web Application Firewall (WAF) | Medium | Easy |
| 16 | Regularly audit user accounts and remove old users | Medium | Easy |
| 17 | Disable directory browsing | Low | Easy |
| 18 | Use a content security policy (CSP) header | Low | Hard |
Items 1 through 4 are critical because they address the three biggest attack vectors. Any WordPress site that has updates enabled, strong passwords, 2FA, and a security plugin is already more secure than 80 percent of sites on the web. The remaining items harden the site against more sophisticated attacks.
What to do if your site is hacked
Even with good prevention, sites get compromised. If you discover your site has been hacked, act quickly and methodically. The first step is to isolate the site by taking it offline or replacing it with a static maintenance page. This prevents the hack from spreading to visitors or affecting your SEO ranking through spam content.
Next, restore from your most recent clean backup. This is why items 14 and 15 in the checklist are so important. If you have a tested backup from before the infection, restoration takes minutes. If you do not have a backup, the recovery process is significantly harder and may require a professional security service to clean the files and database.
After restoration, change every password: WordPress admin, FTP/SFTP, database, and hosting panel. Update all software to the latest versions. Scan the site with your security plugin to confirm the malware is gone. Finally, identify how the attacker got in and fix that vulnerability before putting the site back online. Knowing how to secure a WordPress site after a hack is just as important as preventive measures.
The role of hosting in security
Your hosting provider is your first line of defence. Server-level security measures protect your site before any WordPress code runs. A good host isolates accounts so a compromised neighbour site cannot affect yours. They also provide server-level firewalls, DDoS protection, malware scanning, and automatic PHP version updates.
Managed hosting providers that understand WordPress security go further. They monitor for known vulnerabilities, block malicious IP ranges, enforce secure FTP, and provide one-click restore points. Shared hosting with proper isolation (private shared or account separation) is significantly more secure than older shared hosting models where all accounts share the same pool of resources.
When evaluating how to secure a WordPress site, start with the hosting layer. No amount of WordPress-level hardening compensates for a host that leaves the server unpatched or allows cross-account contamination. Our hosting platform includes server-level firewalls, account isolation, automatic malware scanning, and daily backups as standard features on every plan from BD 3.5 per month.
Frequently asked questions
Outdated software is the single biggest cause. When WordPress core, plugins, or themes fall behind on updates, known vulnerabilities become easy targets for automated attack scripts.
A security plugin is essential but not sufficient on its own. It must be combined with strong passwords, regular updates, 2FA, proper file permissions, and good hosting security. No single layer is enough.
Apply security updates immediately. Major version updates can wait 24 to 48 hours for compatibility verification. Use automatic background updates for minor security releases.
Yes. A good host provides server-level firewalls, malware scanning, DDoS protection, automatic PHP updates, and isolation between accounts. Server-level security complements your WordPress-level measures.
Isolate the site immediately, restore from a clean backup, change all passwords, update everything, scan for remaining malware, and identify the entry point. If you do not have a clean backup, use a security service to clean the site.