WordPress runs a large share of the web, which makes it a common target for automated attacks. Most hacked WordPress sites are not targeted personally: bots scan thousands of sites for old plugins, weak passwords and open login pages. The good news is that a few habits block almost all of these attacks. Here is the checklist we use on the websites we build and maintain.
1. Keep everything updated
Outdated plugins are the most common way into a WordPress site. Update WordPress core, plugins and the theme regularly, and remove plugins you no longer use rather than just deactivating them. Take a backup before major updates and check the key pages afterwards.
2. Use fewer, better plugins
Every plugin is extra code that can contain a vulnerability. Install plugins only from trusted sources, check when they were last updated, and avoid “nulled” (pirated) premium plugins, which often contain malware. On our sites we use our own maintained plugins for SEO, forms, security and consent, which keeps the plugin list short.
3. Strong passwords and two-factor authentication
- Give every user their own account and a unique, long password stored in a password manager.
- Turn on two-factor authentication (2FA) for every administrator.
- Give people the lowest role they need: an Editor does not need to be an Administrator.
- Remove accounts for people who no longer work with you.
4. Protect the login page
Limit failed login attempts, show generic error messages that do not reveal whether a username exists, and consider moving the login address away from the default /wp-login.php. Make sure your public display name is different from your login username.
5. Backups you can actually restore
Keep automatic daily backups stored away from the website’s own server, keep several weeks of history, and test a restore at least once. A backup you have never restored is a hope, not a plan.
6. Secure hosting
Good hosting does a lot of the work: up-to-date PHP, a web application firewall, malware scanning, isolated accounts and free SSL. Our web hosting runs on LiteSpeed with Imunify360 security and daily backups kept for 30 days.
7. HTTPS everywhere
Every page should load over HTTPS, with the http version redirecting to it. Browsers mark http pages as “not secure”, and forms on them can expose personal data.
8. Harden WordPress settings
- Disable file editing from the dashboard.
- Block PHP from running in the uploads folder.
- Hide the WordPress version number.
- Disable XML-RPC if you do not use it.
9. Monitor and get alerts
Keep a log of logins and changes, get an email when something unusual happens, and check core files against the official WordPress checksums. Uptime monitoring tells you quickly if the site goes down.
10. Have a plan for when something goes wrong
Know who to call, where the backups are and how to restore them. If your site is hacked: take it offline or into maintenance mode, change all passwords, restore a clean backup, update everything and find how the attacker got in.
Let us look after it
Our WordPress maintenance service covers updates with backups and checks, security monitoring and help when something breaks. Ask us for a review of your site.