A Complete Guide to Boosting Your WordPress Site’s Security

WordPress runs a large share of the web, which makes it a constant target for automated attacks. That doesn’t make it insecure. It means an unmaintained WordPress site will be found and probed quickly, and the gaps attackers use are almost always predictable.

This guide covers the measures we apply to the WordPress sites we maintain, in roughly the order they reduce risk.

How WordPress sites actually get hacked

WordPress core has a dedicated security team and ships security fixes as automatic minor updates. The weaker points are the components added on top of it. Vulnerability databases maintained by Patchstack and Wordfence consistently show that vulnerable plugins and themes account for the large majority of WordPress vulnerabilities, with core responsible for very few.

The other common entry points are:

• Reused or leaked passwords tried against wp-login.php and XML-RPC.
• Abandoned plugins that no longer receive security fixes.
• Nulled (pirated) premium themes and plugins, which frequently contain backdoors.
• Shared hosting where one compromised account can affect others on the same server.
• Outdated PHP versions that no longer receive security support.
• Too many administrator accounts, including old ones belonging to former staff or contractors.

Keep WordPress, plugins, themes and PHP updated

Updates are the most effective security measure available, because most attacks exploit vulnerabilities that already have a fix. Minor WordPress core releases update automatically by default. Plugins and themes can be set to auto-update, but on business sites we prefer reviewing and testing updates on a staging site first, then applying them promptly to production.

• Remove plugins and themes you don’t use. Deactivated code is still on the server and can still be exploited.
• Replace plugins that haven’t been updated in a long time or have been closed on WordPress.org.
• Only install premium plugins and themes from the original vendor. Never use nulled copies.
• Run a PHP version that still receives security support, and test compatibility before upgrading.

Lock down logins

Use strong passphrases and a password manager

Length matters more than complexity rules. A long passphrase or a randomly generated password stored in a password manager such as 1Password or Bitwarden is far stronger than a short password with a symbol added. Never reuse a WordPress password anywhere else, because credentials leaked from other services are routinely tested against WordPress logins.

Turn on two-factor authentication

Two-factor authentication (2FA) stops most credential attacks even when a password has leaked. WordPress core doesn’t include it, so add it with the Two-Factor plugin maintained by WordPress contributors, Wordfence Login Security, or the 2FA features in Solid Security. Require it for every account that can publish or change settings, and at minimum for all administrators.

Limit login abuse

Rate limiting and lockouts on failed logins slow down brute-force attempts. Most security plugins and managed hosts provide this. If nothing on your site uses XML-RPC (the Jetpack plugin and some mobile apps do), disabling it removes another login endpoint. Changing the login URL can reduce noise in your logs, but it is not a substitute for 2FA.

Apply least-privilege user roles

Every user should have the lowest role that lets them do their job. WordPress includes Administrator, Editor, Author, Contributor and Subscriber roles, and WooCommerce adds Shop Manager.

• Keep administrator accounts to the few people who manage plugins, themes and settings.
• Give content teams Editor or Author roles.
• Give developers and agencies individual accounts rather than a shared login, and remove them when the work ends.
• Avoid generic usernames such as “admin”, and review the user list regularly for accounts you don’t recognize.
• Revoke unused application passwords under each user’s profile.

Harden the WordPress configuration

A few changes in wp-config.php and on the server remove common attack paths:

• Add define( 'DISALLOW_FILE_EDIT', true ); to disable the theme and plugin file editors in the admin, so a stolen admin login can’t be used to inject PHP directly. On sites deployed from Git, DISALLOW_FILE_MODS goes further by blocking plugin and theme installs from the admin.
• Serve the whole site over HTTPS and redirect all HTTP traffic.
• Set correct file permissions and keep wp-config.php out of public reach.
• Block PHP execution in the uploads directory.
• Rotate the authentication keys and salts in wp-config.php if you suspect a compromise, which signs every user out.

Put a web application firewall in front of the site

A web application firewall (WAF) filters malicious requests before they reach WordPress, including SQL injection, cross-site scripting and known plugin exploits. A WAF at the network edge, such as Cloudflare’s or the one included with your managed host, blocks traffic before it uses server resources and also absorbs most denial-of-service traffic. An application-level firewall in a plugin such as Wordfence can see WordPress context, such as which user is logged in. Many sites use both.

Some services also offer virtual patching, which blocks attempts to exploit a specific plugin vulnerability before an update is available. Patchstack is built around this approach.

Choose a security plugin carefully

A security plugin bundles several of these measures in one place. Common, well-maintained options include:

• Wordfence. Application firewall, malware scanner, login security and 2FA.
• Solid Security (formerly iThemes Security). Hardening settings, 2FA, login protection and vulnerability checks.
• Sucuri Security. File integrity monitoring, auditing and hardening, with an optional cloud firewall.
• Patchstack. Vulnerability alerts and virtual patching for plugins and themes.

Run one primary security plugin rather than several overlapping ones, and check what your host already provides. Some managed hosts restrict certain security plugins because their features duplicate the platform’s own protections.

Scan for malware and monitor activity

Scheduled malware scans compare core files against official checksums and look for known malicious code. You can verify core files yourself with wp core verify-checksums in WP-CLI. Pair scanning with monitoring:

• An activity log plugin such as WP Activity Log or Simple History records logins, user changes, plugin installs and content edits.
• Uptime monitoring alerts you when the site goes down or starts returning errors.
• Google Search Console reports security issues and malware warnings Google detects on your site.

Keep offsite backups

Backups don’t prevent an attack, but they decide how quickly you recover from one. Keep automated daily backups of files and database, store at least one copy away from your hosting account, and test that you can restore them. Our guide to WordPress backup solutions covers this in detail.

Choose secure hosting

Your host controls the server, PHP version, isolation between accounts and the network in front of your site. Managed WordPress hosts isolate each site, apply server patches, run firewalls and malware scanning, and support you if something goes wrong. Hey Reliable uses and recommends WP Engine. Read more in our guide on how to choose a WordPress host.

What to do if your site is hacked

1. Contain it. Put the site into maintenance mode or ask your host to take it offline if visitors are being redirected or served malware.
2. Contact your host. Managed hosts can often identify the entry point and help with cleanup.
3. Change every credential. Reset passwords for WordPress users, hosting, SFTP, the database and any connected services, and rotate the keys and salts in wp-config.php.
4. Remove unknown users. Check for administrator accounts you didn’t create.
5. Clean or restore. Restore a clean backup from before the compromise, or clean the files and database with a scanner and manual review. A restore alone doesn’t close the hole, so find the entry point.
6. Patch the cause. Update or remove the vulnerable plugin or theme, then update everything else.
7. Request a review. If Google flagged the site, request a review in Search Console once it is clean.

Frequently asked questions

Is WordPress secure?

Yes, when it is maintained. Core is patched quickly by a dedicated security team. Most incidents involve outdated or vulnerable plugins and themes, weak or reused credentials, or poor hosting, all of which you can control.

Do I need a security plugin if my host has a firewall?

Not always. A good managed host covers the firewall, malware scanning and server hardening. You may still want a plugin for two-factor authentication and activity logging. Check your host’s list of disallowed plugins first.

Should I enable automatic plugin updates?

For small sites, automatic updates are better than no updates. For business and ecommerce sites, test updates on staging and apply them promptly, so a security fix goes live quickly without an untested change breaking checkout.

How do I know if my WordPress site has been hacked?

Common signs include unexpected redirects, spam pages in search results, unknown admin users, unfamiliar files, browser or Google warnings, and sudden traffic or resource spikes. A malware scan and a review of the activity log will usually confirm it.

Keep your site secure without the overhead

Security is ongoing work: updates tested and applied, backups taken, scans and monitoring reviewed. Our WordPress maintenance service covers security hardening, daily malware scans, uptime monitoring, daily backups and tested updates. Get a proposal for your site.

Mary Marnell

Managing Partner · LinkedIn

Mary Marnell is Managing Partner at Hey Reliable, a front-end and WordPress development agency known for delivering clean, reliable code for agencies, marketing teams, and growing businesses. She joined the company in 2017, became partner in ... read more