How to Secure Your WordPress Website From Hackers

Why Do WordPress Websites Get Hacked?

Attackers often use automated tools to scan thousands of websites for known weaknesses.

A website does not need to be famous or receive significant traffic to become a target.

Common causes of WordPress compromises include:

• Outdated plugins, themes or WordPress core files
• Weak or reused passwords
• Stolen administrator credentials
• Abandoned plugins
• Pirated themes or plugins
• Excessive user permissions
• Insecure hosting accounts
• Unprotected login forms
• Malicious file uploads
• Compromised administrator computers
• Incorrect file permissions
• Exposed backup files

What hackers may do after gaining access

• Inject spam pages or links
• Redirect visitors to malicious websites
• Steal customer or user data
• Create hidden administrator accounts
• Send spam email from the server
• Modify payment information
• Install malware or backdoors
• Use the server to attack other websites
• Damage search visibility

1. Keep WordPress, Plugins and Themes Updated

Updates often include fixes for security vulnerabilities, compatibility problems and software bugs.

Running outdated software may leave a known weakness available long after a fix has been released.

Keep these components updated:

• WordPress core
• Active plugins
• Active theme
• Inactive themes that remain installed
• Server PHP version
• Database software where managed by you

Before updating:

• Create a backup
• Check the update notes
• Confirm compatibility
• Use a staging site for major updates where possible
• Test forms, checkout and login functions afterward

Automatic updates

Automatic security updates can reduce the time your website remains exposed after a fix becomes available.

However, websites with complex custom functionality should still be monitored after automatic updates.

2. Remove Unused Plugins and Themes

Deactivating a plugin does not remove its files from the server.

If vulnerable code remains installed, it may still increase the website’s attack surface.

Remove:

• Inactive plugins you no longer use
• Abandoned themes
• Old backup plugins
• Duplicate security tools
• Unused page builders
• Temporary migration plugins
• Test plugins installed during development

Keep one fallback theme

You may keep one current default WordPress theme for troubleshooting, but remove unnecessary older themes.

Avoid pirated software

Do not install nulled or pirated themes and plugins. Modified packages may contain hidden malware, backdoors or unauthorised advertising code.

3. Use Strong and Unique Passwords

A strong password is long, unique and not reused on another service.

Reusing the same password across email, hosting and WordPress increases the damage if one account is compromised.

Protect all important accounts:

• WordPress administrators
• Hosting dashboard
• Domain registrar
• Business email
• Database administrator
• CDN or firewall account
• Backup storage

Use a password manager

A reputable password manager can generate and store unique credentials without requiring you to memorise every password.

Avoid predictable credentials

Do not use:

• Company name followed by a year
• Domain name
• Personal names
• Simple keyboard patterns
• The same password for multiple administrators

4. Enable Two-Factor Authentication

Two-factor authentication requires another form of verification in addition to the password.

This can prevent many account compromises even when an attacker obtains the password.

Common verification methods include:

• Authenticator applications
• Hardware security keys
• Passkeys
• One-time recovery codes
• Email codes

Prioritise these accounts:

• WordPress administrators
• Hosting account
• Domain registrar
• Primary email account
• Backup-storage account

Store recovery codes safely

Keep recovery codes outside the WordPress website. If the site becomes inaccessible, codes stored only inside it may not help.

5. Limit User Access and Administrator Privileges

Not every person who works on a website requires administrator access.

WordPress user roles include:

• Administrator
• Editor
• Author
• Contributor
• Subscriber

Follow the principle of least privilege

Give every user only the permissions needed to complete their work.

Regularly review users

• Remove former employees and contractors
• Delete unknown accounts
• Downgrade unnecessary administrators
• Review recently created accounts
• Require separate accounts instead of sharing one login

Protect the main administrator account

Avoid using an obvious administrator username and do not publish the login username unnecessarily.

6. Use Secure and Maintained WordPress Hosting

Your hosting environment affects the security of the files, database and server.

Look for hosting that provides:

• Regular server updates
• Malware monitoring
• Account isolation
• Automatic backups
• Web application firewall options
• DDoS protection
• Secure file transfer
• Supported PHP versions
• Clear security incident support

Shared hosting considerations

Shared hosting is not automatically insecure, but account isolation and server maintenance are important when several websites share infrastructure.

Protect the hosting account

• Enable two-factor authentication
• Remove old FTP accounts
• Use SFTP instead of unencrypted FTP where available
• Review access logs
• Remove unused databases

7. Enable HTTPS and Maintain a Valid SSL Certificate

HTTPS encrypts information exchanged between visitors and the website.

It protects login credentials, form submissions and other data while it travels across the network.

Confirm that:

• The SSL certificate is valid
• The certificate covers the primary domain
• The www and non-www versions are handled correctly
• HTTP redirects to HTTPS
• WordPress Address uses HTTPS
• Site Address uses HTTPS
• No important assets load through insecure HTTP

Mixed content

Mixed-content warnings occur when an HTTPS page loads scripts, images or styles through an insecure HTTP connection.

8. Create Reliable Off-Site Backups

A backup is one of the most important parts of a security strategy because prevention can never remove every risk.

A complete WordPress backup should include:

• Database
• Uploaded media
• Theme files
• Plugin files
• Configuration files
• Custom code

Keep backups off-site

Do not store every backup inside the same hosting account. If the server is compromised or deleted, local backups may also be lost.

Use multiple backup copies

A practical approach is to keep:

• A recent automatic backup
• Several older restore points
• An off-site copy
• A backup created before major updates

Test restoration

A backup is only useful when it can be restored. Test the process on staging or with help from the hosting provider.

9. Install One Reputable WordPress Security Plugin

A security plugin can help monitor login attempts, scan files, detect changes and apply protective rules.

Useful features may include:

• Login-attempt limiting
• Two-factor authentication
• Malware scanning
• File-change monitoring
• Firewall rules
• Security alerts
• User activity logs
• IP blocking

Avoid installing several overlapping security plugins

Multiple plugins performing identical scans, firewall checks and login controls may conflict or consume excessive server resources.

Configure alerts carefully

Enable notifications for important events without creating so many alerts that genuine warnings are ignored.

10. Use a Web Application Firewall

A web application firewall filters and monitors web traffic before it reaches the application.

It may help block malicious requests, exploit attempts, abusive bots and suspicious traffic patterns.

Firewall options include:

• Server-level firewall
• WordPress security-plugin firewall
• Cloud-based firewall or CDN
• Managed hosting firewall

A cloud firewall can also help with:

• DDoS mitigation
• Rate limiting
• Bot filtering
• Geographic traffic controls
• Blocking known malicious addresses

Do not block legitimate users

Review firewall logs after changing rules. Overly aggressive settings can block search engines, payment providers, forms or administrators.

11. Protect the WordPress Login Page

Automated brute-force attacks repeatedly try username and password combinations.

Strengthen login security by:

• Enabling two-factor authentication
• Limiting repeated failed login attempts
• Using a firewall or rate limiting
• Removing inactive users
• Using unique passwords
• Monitoring failed logins
• Adding CAPTCHA where appropriate

Changing the login URL

Changing the default login URL can reduce some automated noise, but it should not be treated as the main security control.

Attackers may still discover the login route or exploit another vulnerability.

XML-RPC

Some plugins and external applications use XML-RPC. Do not disable it blindly if the website depends on it.

Where it is not required, a security tool may restrict abusive XML-RPC requests.

12. Protect Important WordPress Files and the Database

WordPress configuration files contain sensitive information and should not be publicly accessible.

Important areas include:

• wp-config.php
• .htaccess or server configuration
• Database credentials
• Backup files
• Error logs
• Environment files

File permissions

Files and folders should use permissions appropriate for the hosting environment.

Do not make files broadly writable unless the hosting provider or developer specifically requires it.

Disable file editing

Website owners may disable the built-in theme and plugin editor to reduce the ability to modify code through the WordPress dashboard.

This can be configured carefully inside wp-config.php:

define( 'DISALLOW_FILE_EDIT', true );

Protect database access

• Use strong database credentials
• Do not expose database management tools publicly
• Delete unused databases
• Restrict remote database access
• Keep credentials outside public documents

13. Monitor Login, File and User Activity

Security monitoring helps you identify suspicious behaviour before it becomes a larger incident.

Monitor events such as:

• Administrator logins
• Failed login attempts
• New user creation
• Plugin installation
• Theme activation
• File modifications
• Changes to payment settings
• Unexpected redirects
• Changes to DNS or hosting

Keep logs securely

Important logs should remain available even if the WordPress installation becomes compromised.

Review hosting logs

Server access and error logs may reveal suspicious requests, repeated login attempts or unusual activity.

14. Scan for Malware and Unexpected File Changes

A malware scan can identify suspicious code, modified core files, injected links and known malicious patterns.

Possible signs of compromise include:

• Unknown files
• New administrators
• Spam pages in search results
• Redirects to unrelated websites
• Browser security warnings
• Sudden server resource usage
• Emails being sent unexpectedly
• Modified payment details

Use more than one source of evidence

A security plugin, hosting scan and external website scan may detect different issues.

False positives

Not every unfamiliar file is malicious. Confirm suspicious findings before deleting important application files.

15. Protect Forms, Comments and User Registration

Public forms can be abused for spam, fraudulent registrations and automated attacks.

Protect forms by:

• Using CAPTCHA or anti-spam protection
• Rate limiting repeated submissions
• Validating uploaded files
• Restricting file types
• Limiting upload size
• Keeping form plugins updated
• Sending notifications for suspicious submissions

Disable registration if it is not needed

Check:

Settings → General → Membership

If visitors do not need accounts, confirm that public registration is disabled.

Review the default new-user role

New public users should not receive administrator or editor permissions.

16. Review WordPress Application Passwords

Application passwords allow external tools and integrations to access WordPress without using the user’s primary login password.

Review them regularly

• Delete credentials for integrations you no longer use
• Create separate credentials for each application
• Do not share one application password across several tools
• Revoke a credential immediately after suspected exposure

Application passwords are not dashboard passwords

They are intended for programmatic access and can be revoked individually.

What to Do if Your WordPress Website Is Hacked

Step 1: Do not panic or delete evidence

Record the symptoms, suspicious URLs, warnings and approximate time the problem began.

Step 2: Contact the hosting provider

Ask whether the server shows malware, suspicious processes, modified files or unusual traffic.

Step 3: Place the site in a controlled maintenance state

For serious incidents involving visitors or payments, limit public access while the problem is investigated.

Step 4: Change important credentials

• WordPress administrators
• Hosting account
• Domain registrar
• Database
• SFTP or SSH
• Business email
• API credentials

Step 5: Remove unknown administrators

Review every WordPress user account.

Step 6: Scan and clean the website

Use professional help when the compromise is extensive or involves customer data.

Step 7: Reinstall trusted software

Replace compromised WordPress core, plugin and theme files with clean copies from official sources.

Step 8: Restore from a clean backup where appropriate

Confirm that the backup was created before the compromise.

Step 9: Identify the entry point

Without fixing the original vulnerability, the attacker may return after the website is cleaned.

Step 10: Review legal and notification obligations

When personal or payment data may have been exposed, obtain appropriate professional guidance for applicable privacy and breach-notification requirements.

WordPress Security Checklist

Final Verdict: How to Secure Your WordPress Website From Hackers

If you want to secure your WordPress website from hackers, begin with the fundamentals rather than looking for one perfect security plugin.

Keep WordPress, themes and plugins updated. Remove software you do not use. Protect administrator accounts with unique passwords and two-factor authentication. Limit user permissions, enable HTTPS and maintain tested off-site backups.

A reputable security plugin and firewall can provide important monitoring and protection, but they should support—not replace—secure hosting, responsible maintenance and controlled access.

Review logs and users regularly so that suspicious changes are found quickly. If the website is compromised, clean it carefully, replace exposed credentials and identify the original entry point before returning it to normal use.

Frequently Asked Questions