How to Secure Your WordPress Website: 12-Step Hardening Guide

Key Takeaways

• WordPress powers over forty-three percent of all websites on the internet, making it the most targeted platform for automated hacking attempts security is not optional, it is foundational.
• The majority of WordPress hacks are not sophisticated targeted attacks. They are opportunistic automated scans exploiting known vulnerabilities in outdated plugins, weak passwords, and default configurations.
• Most WordPress security problems are preventable. The twelve steps in this guide address the vulnerabilities that account for the overwhelming majority of real-world WordPress compromises.
• Keeping WordPress core, themes, and plugins updated is the single highest-impact security action available to any WordPress website owner it closes the known vulnerabilities that automated attacks exploit most frequently.
• A strong, unique password combined with two-factor authentication makes your login essentially immune to brute-force attacks the most common automated attack vector against WordPress sites.
• A Web Application Firewall (WAF) through Cloudflare or a security plugin blocks malicious traffic before it reaches your server, protecting against the most common attack patterns without any manual intervention.
• Security is a layered defense. No single step provides complete protection. The goal is to make your site difficult enough to compromise that automated attacks move on to easier targets.
• Maintaining security long-term requires the same consistent discipline as maintaining a backup strategy monthly check-ins, prompt updates, and awareness of new threats in the WordPress ecosystem.

Introduction

WordPress is the most popular content management system in the world and that popularity comes with a consequence. It is also the most attacked.

Every day, automated bots scan millions of WordPress websites looking for known vulnerabilities: outdated plugins with published security flaws, weak passwords susceptible to brute-force guessing, default login URLs that make credential attacks trivially easy, and misconfigured file permissions that allow unauthorized file modifications. When they find a vulnerable site, they exploit it automatically, without human involvement, often without the site owner knowing anything has happened until the damage is extensive.

The good news is that the vast majority of these attacks are opportunistic, not targeted. They are not after your specific website. They are sweeping the internet for any WordPress installation with a known weakness they can exploit. This means that making your site meaningfully more secure than the average WordPress installation which is not a high bar is sufficient to deflect most attacks entirely.

The twelve steps in this guide are not theoretical security measures. They are the specific, practical hardening actions that close the vulnerabilities most commonly exploited against WordPress websites. None of them requires developer skills. Most take under ten minutes to implement. Together they create a layered defense that makes your website genuinely difficult to compromise.

Work through them in order. Do not skip steps because they seem technical every step in this guide has been written to be accessible to any WordPress user regardless of technical background. By the time you reach step twelve, your WordPress security will be considerably stronger than most websites on the internet.

What You Will Learn

In this guide, you’ll learn:

• Why WordPress websites are targeted so frequently and how attacks actually work
• What you need to have in place before starting the hardening process
• All twelve specific hardening steps with complete implementation instructions
• Which security plugins to use and how to configure them
• How a Web Application Firewall works and why it matters
• How to maintain your security posture long-term without significant ongoing effort
• The most common WordPress security mistakes and how to avoid them
• Advanced hardening techniques for website owners who want an extra layer of protection

Why WordPress Security Cannot Be an Afterthought

Most website owners think about security after something goes wrong. A hacked site, a defaced homepage, a sudden flood of spam emails from their domain, or a Google “site may be hacked” warning in search results these are the moments that prompt urgent action.

The problem with reactive security is that by the time the problem is visible, the damage is often already extensive. Hackers who successfully compromise a WordPress site do not always make their presence immediately obvious. Many exploits are designed to operate silently adding spam links to your content, using your server to send phishing emails, installing backdoors for future access, or mining cryptocurrency using your server’s resources while your site continues to function normally for legitimate visitors.

Silent compromises can persist for weeks or months. They can damage your email sender reputation, get your domain blacklisted by Google, cost you real money in hosting overages from resource abuse, and require extensive, expensive remediation work to fully clean.

Proactive security hardening your WordPress installation before any attack occurs is not just more effective than reactive security. It is vastly cheaper, faster, and less stressful. The twelve steps in this guide take a few hours to implement once and provide ongoing protection that requires minimal maintenance thereafter.

How WordPress Sites Get Hacked The Real Attack Vectors

Understanding how attacks actually happen shapes which security measures you prioritise. The vast majority of WordPress compromises fall into a small number of categories.

Vulnerable plugins and themes. Plugins and themes are third-party code with varying levels of security quality. When a security vulnerability is discovered in a widely used plugin and published in WordPress’s vulnerability database automated bots begin scanning for sites running the vulnerable version within hours. Outdated plugins with known CVEs (Common Vulnerabilities and Exposures) are the most common entry point for WordPress compromises.

Brute-force login attacks. WordPress’s default login page is at /wp-admin or /wp-login.php a universally known URL. Automated tools attempt thousands of username and password combinations against this URL hoping to find a match. Sites using “admin” as a username and weak passwords are particularly vulnerable. Successfully guessing credentials gives an attacker full administrative access to your WordPress installation.

Nulled themes and plugins. “Nulled” software is pirated premium themes and plugins distributed for free on unofficial sites. These files almost universally contain malicious code backdoors, malware injectors, and credential stealers that gives attackers persistent access to any site that installs them. Using nulled software is one of the most reliable paths to a compromised WordPress site.

Weak hosting environments. Poorly secured hosting servers particularly cheap shared hosting with outdated software and insufficient isolation between accounts can allow an attacker who compromises one site on the server to affect other sites in the same hosting environment. This is sometimes called a cross-site contamination attack. Reputable managed WordPress hosts like SiteGround and Hostinger implement account isolation that prevents this.

Compromised admin credentials. Email phishing, credential stuffing from data breaches on other services, and reused passwords across multiple platforms all provide pathways to valid WordPress admin credentials without requiring any vulnerability in the WordPress installation itself. If your admin email address and password appear in any data breach, any account using those same credentials is at risk.

Before You Start What You Need in Place First

Before implementing any of the twelve hardening steps, confirm two prerequisites are in place.

A complete, recent backup. Security hardening changes particularly file permission modifications, login URL changes, and XML-RPC disabling can occasionally cause unexpected issues on specific site configurations. A complete backup taken immediately before you begin gives you a clean restoration point if anything needs to be rolled back. Refer to the backup guide on this site if you do not have a backup system in place.

Admin access confirmed. Confirm that you can log in to your WordPress admin dashboard, your hosting control panel, and your domain registrar before making any changes. Some hardening steps particularly login URL changes and two-factor authentication can inadvertently lock you out if implemented incorrectly. Knowing you have alternative access paths (hosting file manager, FTP) reduces the risk of self-inflicted lockout.

Step 1: Keep WordPress Core, Themes and Plugins Updated

If you implement only one step from this entire guide, make it this one. Keeping your WordPress installation core software, themes, and plugins fully updated is the single highest-impact security action available, because it closes the known vulnerabilities that automated attacks exploit most frequently.

The WordPress security team and plugin developers regularly release updates that patch discovered vulnerabilities. When a vulnerability is patched, the fix is publicly documented which simultaneously tells security researchers the site is safe and tells attackers exactly what vulnerability to look for on sites still running the old version. The window between a patch being released and automated attacks targeting the unpatched vulnerability is often measured in hours.

How to Update Everything

In your WordPress dashboard, navigate to Dashboard → Updates. This shows all available updates for WordPress core, plugins, and themes simultaneously. Click Update All for plugins, then update themes, then update WordPress core if a core update is available.

Before updating, ensure your backup from the prerequisites step is current particularly before major WordPress core updates or updates to your primary theme or most critical plugins.

Enabling Automatic Updates

For minor WordPress core updates (security and maintenance releases), automatic updates are enabled by default and should remain so. For major version updates, review release notes before updating on your live site testing on a staging environment first is advisable.

For plugins, automatic updates can be enabled per-plugin in your Plugins list click the Enable auto-updates link next to each plugin. For plugins that are critical to your site’s functionality, you may prefer to review updates manually before applying them. For plugins that are not operationally critical, automatic updates provide ongoing security maintenance with no manual effort.

Set a monthly reminder to review your WordPress dashboard for any pending updates that have not been applied automatically and apply them promptly.

Step 2: Use Strong Passwords and a Password Manager

Brute-force attacks against WordPress login pages are among the most common automated attack types. They work by systematically attempting username and password combinations often using databases of commonly used passwords and known breached credentials until they find a match.

A strong, unique password makes this attack computationally impractical. A password of twelve or more characters combining uppercase and lowercase letters, numbers, and symbols from a random source has billions of possible combinations far beyond the practical reach of any brute-force attack.

Password Requirements for WordPress

Every account with WordPress access administrator accounts, editor accounts, and the email address associated with your admin account should have a unique, strong password that is not used on any other service. Password reuse is one of the most exploited vulnerabilities in credential-based attacks: a password exposed in a breach on any other platform immediately puts every account using that password at risk.

Using a Password Manager

A password manager generates, stores, and autofills strong unique passwords for every account you use eliminating both the security risk of weak passwords and the practical burden of remembering unique credentials for every service.

1Password is one of the most widely used and highly regarded password managers, offering a well-designed interface, strong encryption, cross-device synchronization, and breach monitoring that alerts you when any stored credential appears in a known data breach. Its team and family plan options make it suitable for websites with multiple contributors.

For the passwords most critical to your WordPress security, confirm they meet these minimum standards: at minimum twelve characters, no dictionary words or predictable patterns, not reused from any other service, and stored in your password manager rather than in a browser’s built-in password storage (which is less secure).

Step 3: Change the Default Admin Username

WordPress historically set “admin” as the default administrator username. Brute-force attack tools use “admin” as their first username attempt meaning any site still using this default username has already provided half of the credential pair an attacker needs.

If your primary administrator account uses “admin” as its username, changing it removes one of the most commonly exploited attack vectors.

How to Change the Admin Username

WordPress does not allow direct username changes through the dashboard interface. The most straightforward approach is to create a new administrator account with a distinctive username, log in with the new account, and then delete the original “admin” account reassigning all its content to the new account.

Navigate to Users → Add New. Create a new user with a strong, non-obvious username, your email address, a strong password, and the Administrator role. Log out and log back in with the new account. Navigate to Users, find the original “admin” account, and click Delete. When prompted, choose to attribute all content to your new account before confirming the deletion.

Alternatively, you can change the username directly in the database via phpMyAdmin in your hosting control panel, open phpMyAdmin, select your WordPress database, open the wp_users table, find the admin row, and edit the user_login value to your new username. This method is faster but requires comfort with direct database editing.

Step 4: Enable Two-Factor Authentication

Two-factor authentication (2FA) requires a second verification step typically a time-based one-time code from an authentication app in addition to your password when logging in. Even if an attacker obtains your correct username and password through any means, they cannot log in without physical access to your authentication device.

2FA is one of the most effective individual security measures available. Accounts protected by 2FA are statistically almost immune to credential-based attacks the second factor is simply beyond the reach of remote automated attacks.

Setting Up 2FA on WordPress

Wordfence Security (which we will cover more extensively in Step 5) includes a 2FA feature that integrates directly into the WordPress login process. After installing Wordfence, navigate to Wordfence → Login Security to configure 2FA for your account. You will scan a QR code with an authentication app, and from that point, every login requires both your password and a current one-time code.

Authy is a highly recommended authentication app for generating 2FA codes. Unlike Google Authenticator, Authy supports encrypted cloud backup of your 2FA accounts meaning if you lose your phone, you can restore your authentication codes on a new device rather than being permanently locked out. Install Authy on your smartphone, then use it to scan the QR code provided by your WordPress 2FA plugin.

Enable 2FA for every administrator account on your WordPress installation. If you have multiple admin users, ensure all of them enable 2FA a single admin account without 2FA is the weakest link in your authentication security.

Step 5: Install a WordPress Security Plugin

A dedicated WordPress security plugin provides centralized security management monitoring, scanning, firewall functionality, and login protection through a single interface. Rather than implementing individual security measures through separate plugins, a comprehensive security plugin handles multiple threat vectors simultaneously.

Wordfence Security

Wordfence is the most widely installed WordPress security plugin, with over five million active installations. Its free version provides a comprehensive security foundation that is sufficient for most WordPress websites.

What Wordfence Free includes:
– Web Application Firewall (WAF) that blocks known malicious traffic patterns
– Malware scanner that checks WordPress core files, themes, and plugins against known clean versions and known malware signatures
– Login security including brute-force protection and two-factor authentication
– Live traffic monitoring showing real-time visitor activity including blocked attacks
– Security notifications for detected issues, outdated software, and known vulnerable plugins
– Blocked IP addresses for repeated failed login attempts

Configuring Wordfence:

Install and activate Wordfence from the WordPress plugin directory. On first activation, enter your email address to receive security alerts and complete the setup wizard.

Navigate to Wordfence → Firewall. Click Optimize the Wordfence Firewall and follow the instructions to install the firewall in Extended Protection mode this moves the firewall earlier in the PHP execution process, enabling it to block attacks before WordPress loads, which is significantly more effective than the default Basic WordPress Protection mode.

Navigate to Wordfence → Scan and run your first scan. Wordfence will compare your installation against known clean versions and flag any discrepancies including modified core files, known malware signatures, and publicly accessible sensitive files.

Review and address any issues flagged in the scan results. Critical issues (red) should be addressed immediately. Warnings (yellow) should be reviewed and resolved where applicable.

Sucuri Security

Sucuri is an alternative to Wordfence with a strong reputation for malware detection and post-compromise remediation. Its free plugin provides security activity auditing, file integrity monitoring, remote malware scanning, and post-hack security hardening. Sucuri’s paid plans add a cloud-based WAF and CDN, DDoS protection, and guaranteed malware removal making it a strong option for websites with higher security requirements or a history of compromise.

For most bloggers and small website owners, Wordfence Free provides excellent protection at no cost. Sucuri’s paid plans are worth considering for websites where the cost of a compromise in lost revenue, remediation effort, and reputation damage justifies the investment in professional-grade protection.

Do not install both Wordfence and Sucuri simultaneously running two security plugins with overlapping firewall and scanning functionality creates conflicts and performance overhead without additional protection benefit.

Step 6: Limit Login Attempts

By default, WordPress allows unlimited login attempts. This means an automated brute-force tool can attempt thousands of username and password combinations against your login page without any restriction until it either finds valid credentials or is manually blocked.

Limiting login attempts locking an IP address out for a defined period after a specified number of failed attempts makes brute-force attacks impractical. After three or five failed attempts, the attacking IP is blocked for hours or days, reducing the attempt rate from thousands per minute to a handful per day.

Implementing Login Attempt Limits

If you have installed Wordfence (Step 5), login attempt limiting is already active. Navigate to Wordfence → All Options → Brute Force Protection to review and configure the settings. The defaults lock out after five failures within four hours are reasonable for most sites. You can increase security by reducing the failure threshold or extending the lockout period.

If you are not using Wordfence, the **Login LockDown** or **WP Cerber Security** plugins provide login attempt limiting as standalone functionality. Both are available free from the WordPress plugin directory.

Ensure that your own IP address or a trusted IP range is whitelisted before implementing aggressive lockout settings locking yourself out of your own WordPress login due to forgotten password attempts is a recoverable but inconvenient situation.

Step 7: Change the WordPress Login URL

WordPress’s default login URL yourdomain.com/wp-admin and yourdomain.com/wp-login.php is universally known. Every automated brute-force tool begins its attack at these default addresses. Changing the login URL to a custom, non-obvious path eliminates the majority of automated login attacks simply because the attacking tools cannot find the login page.

This is a security-through-obscurity measure it does not make your login credentials stronger, but it dramatically reduces the volume of brute-force traffic your login page receives. Combined with strong passwords, 2FA, and login attempt limiting, a custom login URL creates multiple layers of protection against credential attacks.

How to Change Your Login URL

The **WPS Hide Login** plugin provides the simplest implementation install, activate, and set your preferred login URL in the plugin settings under Settings → WPS Hide Login. Choose a path that is non-obvious and not guessable (not /login, /admin, or /dashboard these are all commonly probed). Something like /my-site-access or a random string works well.

Important: Record your new login URL immediately and store it securely in your password manager, in a secure note, and ideally in more than one location. If you forget your custom login URL, accessing your WordPress dashboard requires editing your database or wp-config.php directly.

If you use Cloudflare as a CDN (Step 11), ensure your custom login URL is not cached by Cloudflare add a Page Rule or Cache Rule excluding your custom login path from caching.

Step 8: Implement SSL and Force HTTPS

SSL (Secure Sockets Layer) and its successor TLS encrypt the connection between your visitor’s browser and your server preventing network attackers from intercepting login credentials, session cookies, or other sensitive data transmitted between the two.

Beyond the security function, SSL is a Google ranking signal, displays the padlock that visitors associate with site trustworthiness, and is a requirement for many modern browser and performance features including HTTP/2.

Installing SSL

Most reputable hosting providers including SiteGround and Hostinger provision free SSL certificates through Let’s Encrypt automatically when you add a domain to your hosting account. Check your hosting control panel’s SSL section to confirm your certificate is active and not expired.

If your hosting does not provide automatic SSL, install a free Let’s Encrypt certificate through your hosting control panel’s SSL/TLS section, or use Cloudflare’s free SSL (covered in Step 11) as an alternative.

Forcing HTTPS

Having an SSL certificate installed is not sufficient you must also ensure that all traffic is served over HTTPS rather than HTTP. Visitors who access your site over HTTP have their data transmitted unencrypted even when an SSL certificate is present.

The most reliable way to force HTTPS on WordPress is through your .htaccess file. Add the following lines at the top of your .htaccess file (accessible via cPanel File Manager or FTP):

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

This redirects all HTTP traffic to HTTPS automatically. After adding these lines, test by navigating to http://yourdomain.com it should redirect immediately to https://yourdomain.com.

Also update your WordPress URL settings to use HTTPS. In your WordPress dashboard navigate to Settings → General and ensure both the WordPress Address and Site Address fields begin with https:// rather than http://.

Step 9: Disable XML-RPC If You Do Not Use It

XML-RPC is a WordPress feature that enables remote publishing allowing third-party applications and services to communicate with your WordPress installation remotely. It was designed for legitimate uses like posting from mobile apps and enabling the Jetpack plugin’s features.

The security problem with XML-RPC is that it provides an alternative authentication pathway that bypasses many of the login protections discussed in previous steps. Attackers use XML-RPC’s multicall feature to attempt thousands of username and password combinations in a single HTTP request dramatically accelerating brute-force attacks and circumventing login attempt limiting.

Checking Whether You Need XML-RPC

Most modern WordPress users do not need XML-RPC. If you do not use the WordPress mobile app to publish posts, do not use Jetpack, and do not have any other service that requires XML-RPC connectivity, disabling it removes an attack surface with no functional cost.

Disabling XML-RPC

The most straightforward method is to add the following to your .htaccess file:

# Disable XML-RPC
<Files xmlrpc.php>
Order Deny,Allow
Deny from all
</Files>

This blocks all access to xmlrpc.php at the server level, before WordPress even processes the request.

Alternatively, the **Disable XML-RPC** plugin (available free from the WordPress plugin directory) handles this with a single activation no file editing required.

If you use Jetpack, note that some Jetpack features depend on XML-RPC. In this case, use Wordfence’s firewall to block XML-RPC attacks from non-Jetpack sources rather than disabling it entirely Wordfence’s firewall rules distinguish between legitimate Jetpack traffic and attack traffic.

Step 10: Set Correct File Permissions

File permissions control which users and processes on your server can read, write, or execute each file and directory. Incorrectly configured file permissions particularly permissions that are too permissive can allow attackers who gain limited access to your server to modify or overwrite files they should not be able to touch.

The recommended WordPress file permission settings are:

– Directories: 755 the web server can read and execute, only the owner can write
– Files: 644 the web server can read, only the owner can write
– wp-config.php: 600 or 640 owner can read and write, no access for anyone else; this file contains your database credentials and should be the most restrictively permissioned file on your installation

Checking and Setting File Permissions

In cPanel, open File Manager and navigate to your public_html directory. Select a directory, right-click, and choose Change Permissions to see and modify its permission settings. The permissions are displayed as a three-digit number (755, 644, etc.) or as a set of checkboxes for owner, group, and public read/write/execute permissions.

For a large WordPress installation with many files, checking and correcting permissions individually is impractical. A more efficient approach is to use your hosting control panel’s terminal or SSH access (if available) with the following commands:

find /path/to/your/wordpress -type d -exec chmod 755 {} \;
find /path/to/your/wordpress -type f -exec chmod 644 {} \;
chmod 600 /path/to/your/wordpress/wp-config.php

Replace /path/to/your/wordpress with your actual WordPress installation path (typically /public_html or /home/username/public_html).

Many security plugins including Wordfence and Sucuri include file permission checks in their security scans and will flag directories or files with insecure permissions.

Step 11: Use a Web Application Firewall (WAF)

A Web Application Firewall inspects incoming HTTP traffic before it reaches your WordPress application and blocks requests that match known malicious patterns SQL injection attempts, cross-site scripting (XSS) payloads, known exploit signatures, and traffic from IP addresses with established malicious histories.

A WAF operates as an intelligent filter between the internet and your website, allowing legitimate traffic through while blocking attack traffic before it can interact with your application.

Cloudflare WAF

Cloudflare provides a WAF as part of its network, available on its free plan with a managed ruleset that covers the most common web application attack patterns. When you route your domain through Cloudflare by updating your nameservers to Cloudflare’s all traffic to your domain passes through Cloudflare’s global network where the WAF inspects it before it reaches your origin server.

Cloudflare’s free plan WAF protects against common threats. Cloudflare’s paid plans (Pro and above) add additional managed rulesets specifically covering WordPress attack patterns, more granular custom rule capabilities, and bot management features.

Adding Cloudflare to your WordPress site involves creating a Cloudflare account, adding your domain, and updating your domain’s nameservers to the ones Cloudflare provides. Cloudflare’s setup wizard handles the DNS configuration automatically, importing your existing DNS records before you change nameservers to minimise disruption.

Wordfence Firewall

If Cloudflare is not in your stack, Wordfence’s endpoint WAF (configured in Extended Protection mode as described in Step 5) provides application-layer firewall protection within your WordPress installation. While it operates at a different layer than Cloudflare’s network-level WAF meaning attack traffic does reach your server before being blocked it is effective at preventing common WordPress-specific attack patterns.

For the strongest WAF protection, combining Cloudflare’s network-level WAF with Wordfence’s application-level endpoint WAF provides defense at two separate layers network traffic is filtered by Cloudflare before reaching your server, and any traffic that reaches WordPress is further filtered by Wordfence.


Step 12: Run Regular Security Scans

Security hardening is not a one-time event. New vulnerabilities are discovered in WordPress plugins regularly. Hosting environments change. New attack techniques emerge. Running regular security scans ensures that any new vulnerabilities, unexpected file modifications, or signs of compromise are identified and addressed before they escalate.

Running Malware Scans with Wordfence

Navigate to Wordfence → Scan and click Start New Scan. Wordfence will check your WordPress core files against known clean versions, scan all installed plugins and themes against their repository versions and known malware signatures, check for known backdoors and suspicious code patterns, verify file permissions, and check your domain against Google’s Safe Browsing list.

Review the scan results carefully. Critical issues modified core files, known malware signatures, publicly accessible sensitive files require immediate attention. Wordfence provides remediation guidance for each identified issue directly in the scan results.

Schedule automatic scans in Wordfence → All Options → Scans to Schedule. Weekly automated scans catch new issues promptly without requiring manual initiation.

Monitoring WordPress Activity

Beyond malware scanning, monitoring your WordPress activity log helps detect suspicious behavior multiple failed login attempts, unexpected new admin user creation, unusual plugin installations, or content modifications you did not make. Wordfence’s Live Traffic view provides real-time activity monitoring. For more detailed audit logging, the WP Activity Log plugin creates a comprehensive record of every action taken in your WordPress installation, making it straightforward to identify the source and scope of any suspicious activity.

After the 12 Steps Maintaining Your Security Long Term

Implementing the twelve steps provides a strong security foundation. Maintaining that foundation requires consistent but modest ongoing effort.

Monthly tasks: Review your WordPress dashboard for pending updates and apply them. Check your Wordfence scan results for any new issues. Verify that your automated backups are completing successfully. Review Wordfence’s blocked attacks log to identify any unusual patterns.

Quarterly tasks: Run a full Wordfence scan and review results in detail. Check user accounts remove any accounts that are no longer needed and confirm all admin accounts have 2FA enabled. Review installed plugins and themes deactivate and delete anything that is no longer used (inactive plugins are still a security risk if they contain vulnerabilities). Check that your SSL certificate is not approaching its expiry date.

Immediately when notified: Apply any security updates flagged as critical by Wordfence, your hosting provider, or WordPress.org security advisories. Change passwords for any credentials that appear in breach notifications from your password manager. Review your site for any unexpected content or user changes if any intrusion attempt is detected.

Common WordPress Security Mistakes to Avoid

Using nulled themes or plugins. Pirated premium themes and plugins are one of the most reliable vectors for WordPress compromise. They almost universally contain malicious code and represent an ongoing security liability. Use only legitimate software from the WordPress repository, official plugin developers, or reputable commercial plugin providers.

Keeping unused plugins and themes installed. Inactive plugins remain vulnerable to exploitation even when deactivated their files exist on your server and can be targeted. Delete any plugin or theme you are not actively using. Keep a minimal plugin footprint overall every additional plugin is an additional potential attack surface.

Using the same password across multiple services. Password reuse means that a breach on any service you use regardless of whether it is security-related can expose your WordPress credentials. Every account gets a unique password, managed through a password manager like 1Password.

Ignoring security plugin warnings. Security plugins generate alerts for a reason. Dismissing Wordfence notifications about outdated plugins, flagged files, or blocked attacks without reviewing them leaves known vulnerabilities unaddressed. Review every security notification and address critical items promptly.

Not testing your login recovery path. Changing your login URL (Step 7) and enabling 2FA (Step 4) without confirming an alternative access method if something goes wrong is a recipe for self-inflicted lockout. Always confirm that you can access your site via hosting file manager or FTP before implementing changes that could restrict your primary access path.

Choosing hosting based on price alone. Cheap shared hosting with inadequate account isolation, outdated server software, and minimal security infrastructure creates vulnerabilities that no WordPress-level hardening can fully compensate for. Reputable managed WordPress hosts like SiteGround and Hostinger implement server-level security measures account isolation, automatic malware scanning, WAF at the hosting level that significantly reduce the risk of compromise regardless of WordPress configuration.

Never updating WordPress core. Major WordPress core updates are sometimes delayed by website owners concerned about compatibility issues. While caution before major updates is reasonable, delaying security releases which are smaller, targeted patches is never appropriate. Enable automatic minor core updates and apply major updates promptly after brief compatibility review.

Pro Tips for Advanced WordPress Hardening

Add security headers to your HTTP responses. Security headers instruct browsers on how to handle your site’s content and protect against specific attack types including clickjacking, cross-site scripting, and content type sniffing. The key headers to implement are Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy. Cloudflare allows custom security header configuration through Transform Rules. Alternatively, add headers through your .htaccess file or through a plugin like Headers Security Advanced & HSTS WP.

Move wp-config.php above the web root. WordPress automatically looks for wp-config.php one directory level above the WordPress root, which means you can move this sensitive file outside of your publicly accessible web directory entirely. This ensures that even if a configuration error temporarily exposes raw PHP files to the browser, wp-config.php containing your database credentials is not accessible. This requires moving the file via FTP or File Manager and does not require any code changes.

Disable the WordPress file editor. The built-in WordPress theme and plugin editor accessible via Appearance → Theme Editor and Plugins → Plugin Editor allows PHP code modification directly through the browser. If an attacker gains admin access, this editor provides immediate code execution capability. Disable it by adding the following to wp-config.php:

define( ‘DISALLOW_FILE_EDIT’, true );

This removes the editor from the admin interface entirely without affecting any site functionality.

Hide your WordPress version number. WordPress displays its version number in your site’s HTML source and in your RSS feed by default. Knowing which WordPress version a site runs helps attackers identify whether known vulnerabilities apply. Remove the version number by adding the following to your theme’s functions.php file:

remove_action(‘wp_head’, ‘wp_generator’);

Implement database table prefix changes. WordPress uses wp_ as the default prefix for all database table names. Attackers crafting SQL injection exploits frequently target tables by their default names. Changing the table prefix done during initial WordPress installation or with a plugin like WP-DBManager after installation makes SQL injection attempts targeting default table names ineffective. This is a more advanced operation that requires care to implement correctly on an existing installation.

Monitor for new admin accounts. Unexpected creation of new administrator accounts is one of the clearest signals of an active compromise. Wordfence’s email alerts include new user registration notifications. Ensure these alerts are enabled and review any unexpected admin account creation immediately as a potential indicator of compromise.

Frequently Asked Questions

Is WordPress secure out of the box?
WordPress core is maintained by a dedicated security team and is generally secure in its default state. The majority of WordPress security vulnerabilities come from third-party plugins and themes, weak credentials, and outdated software not from WordPress core itself. An out-of-the-box WordPress installation with no plugins, using strong credentials, kept fully updated, would be quite difficult to compromise. The problem is that real-world WordPress sites use many plugins, sometimes neglect updates, and occasionally use weak passwords which is why the additional hardening steps in this guide are important.

Do I need a paid security plugin or is Wordfence Free sufficient?
For most bloggers and small website owners, Wordfence Free provides excellent protection its WAF, malware scanner, brute-force protection, and 2FA cover the most important security functions at no cost. Wordfence Premium adds real-time threat intelligence updates (the free version receives threat database updates with a thirty-day delay), country blocking, and real-time IP reputation checking. The premium features are worth considering for higher-traffic websites or those in niches that attract more targeted attack traffic. Sucuri’s paid plans add cloud-based WAF and guaranteed malware removal relevant for websites that have experienced previous compromises.

What should I do if my WordPress site has already been hacked?
First, do not panic take systematic action. Take your site offline immediately to prevent further damage and to stop your compromised server from being used to attack others. Contact your hosting provider’s security team SiteGround, Hostinger, and Cloudways all provide security assistance. Identify a clean backup from before the compromise and plan a restoration. If you cannot identify a clean backup, use Wordfence’s scan or Sucuri’s free malware scanning tool to identify and remove malicious files. After restoration or cleaning, immediately change all passwords, update all software, and implement the full twelve-step hardening process to close the vulnerability that was exploited.

How often should I run security scans?
Weekly automated scans through Wordfence are the recommended minimum for active websites. Run a manual scan immediately after any plugin or theme update, after any reported security vulnerability in software you use, and any time you notice unexpected site behaviour. Monthly manual review of your Wordfence scan history and blocked attacks log provides additional oversight.

Can security plugins slow down my WordPress site?
A well-configured security plugin has minimal impact on site performance for legitimate visitors. Wordfence’s firewall, once configured in Extended Protection mode, operates before WordPress loads for blocked requests meaning blocked traffic consumes very little server resources. The malware scanner does consume server resources when running, which is why it is best scheduled for low-traffic periods (overnight or early morning). If you notice performance degradation after installing a security plugin, review its scan schedule and consider disabling any optional monitoring features that run continuously.

Related Articles

• How to Back Up Your Website: 3 Methods for Every Budget
• How to Speed Up Your Website Through Hosting Optimization
• How to Migrate Your Website to a New Host Without Downtime
• What Is a WordPress Theme? A Beginner’s Guide
• Domain Name vs Web Hosting: What’s the Difference?

Final Thoughts

WordPress security is not a single action it is a layered defense built from multiple reinforcing measures, each of which closes a specific vulnerability that attackers exploit.

None of the twelve steps in this guide requires developer expertise. None takes more than a few minutes to implement. Together they transform your WordPress installation from a default configuration that automated attacks find inviting into a hardened target that the overwhelming majority of attacks will bypass in favor of easier victims.

The effort required to implement all twelve steps is a few hours once. The protection they provide is ongoing, requiring only modest monthly maintenance to sustain. When you consider what a successful hack costs lost traffic, reputation damage, remediation effort, potential data loss, and the genuinely unpleasant experience of discovering your site has been compromised the investment in prevention is one of the most obviously worthwhile things you can do for your website.

Work through the twelve steps in order. Do not skip any. And when you are done, set a monthly reminder to review your Wordfence dashboard, confirm your backups are running, and apply any pending updates.

Your website is worth protecting. Start today.