WordPress & Web Development Basics
How to Secure a WordPress Website Step by Step
A practical, beginner-friendly checklist that closes the security gaps attackers actually use — no developer required.
Photo via Pexels — free to use, no attribution required.
Quick Answer
To secure a WordPress website, keep core, themes, and plugins updated; use strong passwords with two-factor authentication; install an SSL certificate; add a security plugin with a firewall and malware scanner; harden wp-config.php and file permissions; remove unused plugins and accounts; and run automated offsite backups. No single step is a silver bullet — security comes from stacking these layers together.
Table of Contents
WordPress now powers a substantial share of the entire web, which is exactly why it draws so much unwanted attention from automated bots and opportunistic attackers. The good news is that most successful attacks do not exploit some clever, unknown flaw in WordPress itself. They exploit the boring, preventable stuff: an outdated plugin nobody updated, a password that was easy to guess, a login page with no rate limiting, or a host with no backups in place. If you close those gaps, you eliminate the overwhelming majority of real-world risk.
This guide walks through a complete, step-by-step process for locking down a WordPress site, whether it is a personal blog, a small business site, or a client project you manage for someone else. Every step is something you can do yourself, even if you have never touched a line of code. If you are also cleaning up your site's structure, it pairs well with our guide on creating a WordPress child theme, since a child theme protects your customizations the same way a backup protects your content.
Why WordPress Security Actually Matters
It is tempting to assume a small blog or a brand-new site is not worth an attacker's time. In practice, the opposite is true. Most WordPress attacks are not targeted at you personally — they are automated scripts that scan millions of sites looking for known vulnerabilities, weak logins, or outdated software. Your site does not need to be famous to get hit; it just needs to be reachable and unprotected.
A compromised WordPress site can be used to send spam email, host phishing pages, inject hidden links for someone else's SEO scheme, mine cryptocurrency in the background, or serve malware to your own visitors. Search engines are quick to flag infected sites with warning labels, which can wipe out months of organic traffic and search rankings overnight. For anyone monetizing a site through AdSense or affiliate programs, a security incident can also mean account suspensions, since ad networks are strict about sites that have been flagged for malicious content.
None of this requires panic. It requires a checklist — the same one professional WordPress developers run through on every new site they launch.
Understanding Your Site's Attack Surface
Before diving into the checklist, it helps to understand where attacks actually come from. WordPress security threats generally fall into a few categories:
- Outdated software: Old versions of WordPress core, themes, or plugins with publicly known vulnerabilities.
- Weak credentials: Simple passwords, reused logins, or the default "admin" username, all of which make brute-force attacks trivial.
- Vulnerable plugins and themes: Poorly coded or abandoned add-ons that introduce security holes into an otherwise secure core install.
- Insecure hosting: Shared hosting environments with poor account isolation, where a neighboring compromised site can spread to yours.
- Human error: Uploading unnecessary plugins, forgetting to remove old test accounts, or leaving file editing enabled in the dashboard.
Every step in the next section is designed to close one or more of these specific gaps. Think of it less as a one-time task and more as a set of habits layered on top of each other.
The Step-by-Step Security Checklist
Work through these in order. Steps one through six take under an hour combined and address the most common attack vectors immediately. The rest can be handled over the following week.
1Keep WordPress Core, Themes, and Plugins Updated
This is the single most repeated piece of advice in WordPress security, and for good reason. When a plugin developer patches a vulnerability, the patch notes often describe exactly what was broken — which means attackers know precisely which unpatched sites to target. Turn on automatic updates for minor WordPress releases, and check for theme and plugin updates weekly. If you are worried an update might break your site's design, a child theme keeps your custom styling separate from the parent theme's core files, so updates apply safely without wiping out your work.
2Use Strong, Unique Passwords and Enable Two-Factor Authentication
A weak admin password is still one of the most common ways sites get compromised. Use a password manager to generate a long, random password for your WordPress login, your hosting account, and your database — never reuse the same password across all three. Then add two-factor authentication (2FA) using a free plugin, so a stolen password alone is not enough to get in. This single step blocks the vast majority of automated brute-force login attempts.
3Change the Default "Admin" Username
Older WordPress installs, and some careless setups, still use "admin" as the default administrator username. Attackers already know this, so half of a brute-force attack is solved before they even start guessing passwords. Create a new administrator account with a unique username, transfer ownership of your content to it, and delete the old "admin" account entirely.
4Limit Login Attempts and Add a CAPTCHA
By default, WordPress allows unlimited login attempts, which is exactly what brute-force bots rely on. A login-limiting plugin locks out an IP address after a handful of failed attempts, and a simple CAPTCHA on the login form filters out the vast majority of automated bots before they can even try guessing credentials.
5Install an SSL Certificate and Force HTTPS
SSL encrypts the data moving between your visitors' browsers and your server, which protects login credentials, contact form submissions, and payment details from being intercepted. Most hosts now offer a free SSL certificate through Let's Encrypt with one click. Once it is active, force all traffic to HTTPS so there is no unencrypted fallback, and update your internal links accordingly.
6Choose a Security-Focused, Reputable Hosting Provider
Hosting is the foundation everything else sits on. A quality host provides server-level firewalls, automatic malware scanning, account isolation on shared servers, and rapid patching of server software. Cheap, unmanaged hosting is frequently the weak link in an otherwise well-secured WordPress setup, so treat your hosting choice as a security decision, not just a price comparison.
7Install a Trusted WordPress Security Plugin
A dedicated security plugin gives you a web application firewall (WAF), malware scanning, and file-change monitoring in one place. It will alert you the moment something unexpected happens — a new admin account appearing, a core file being modified, or a spike in failed login attempts — so you can react before real damage is done. The comparison table further down covers the most popular options.
8Set Correct File and Folder Permissions
WordPress files should generally be set to 644 and folders to 755, with wp-config.php locked down even further where your host allows it. Overly permissive settings — like 777 — give attackers an easy path to modify files if they gain even limited access. Most hosting control panels let you adjust these under a file manager or FTP client without needing command-line access.
9Disable File Editing From the WordPress Dashboard
By default, an administrator can edit theme and plugin files directly from the WordPress dashboard. If an attacker ever gains admin access, this built-in editor becomes a convenient way to plant malicious code. Disabling it removes that shortcut entirely, forcing any file changes to go through FTP or your hosting file manager instead, which is a much smaller and more defensible attack surface.
10Secure and Harden wp-config.php
wp-config.php holds your database credentials and security keys, making it one of the most sensitive files on your server. Regenerate your unique authentication keys and salts periodically, move the file up one directory level where your host supports it, and add rules to block direct browser access to it. This file should never be reachable by anyone but your server.
11Hide Your WordPress Version Number
By default, WordPress publishes its version number in your page source, which tells attackers exactly which known vulnerabilities might apply to your install. Most security plugins can strip this information automatically, making it slightly harder for automated scanners to fingerprint your setup and target it with version-specific exploits.
12Remove Unused Themes, Plugins, and User Accounts
Every inactive plugin or theme sitting in your install is still a potential vulnerability, even if you never activate it — its code is still present and, in rare cases, still reachable. Delete anything you are not actively using. Do the same audit for user accounts: remove old contributor logins, test accounts, or former team members who no longer need access.
13Set Up Automatic, Offsite Backups
Backups will not prevent an attack, but they are what turns a catastrophic hack into a minor annoyance. Use a plugin or hosting feature that stores backups offsite — on cloud storage separate from your web server — on a daily or weekly schedule depending on how often your content changes. Test a restore at least once so you know the process actually works before you need it in a real emergency.
14Monitor Your Site and Schedule Regular Security Scans
Set your security plugin to run automated malware scans on a schedule, and pay attention to the email alerts it sends. Catching an issue within hours of it happening is dramatically easier to clean up than discovering it weeks later, after search engines have already flagged the site or your hosting provider has suspended the account.
Comparing WordPress Security Plugins
Picking a security plugin is one of the most consequential decisions in this whole process, since it handles several checklist items — firewall, scanning, and login protection — at once. Here is how the three most widely used options compare.
| Plugin | Firewall Type | Malware Scanning | Best For |
|---|---|---|---|
| Wordfence | Application-level (runs on your server) | Included free, with signature updates | Site owners who want deep visibility and control, free tier is generous |
| Sucuri | DNS-level (cloud-based, blocks traffic before it reaches your server) | Included, plus a cleanup guarantee on paid plans | Sites that have been attacked before, or want cloud-level protection |
| iThemes / Solid Security | Application-level | Basic scanning, focused on hardening settings | Beginners who want an automated setup wizard for hardening steps |
There is no universally "best" choice here — Sucuri's cloud firewall filters traffic before it ever touches your server, which is a meaningful advantage for high-traffic or previously compromised sites, while Wordfence's on-server approach gives more granular visibility into what is actually happening. For most beginners running a single site, any one of these three, properly configured, is a significant upgrade over running no security plugin at all.
Free vs. Premium: What's Actually Worth Paying For
Not every security measure requires spending money. This table separates what you can do for free from what is genuinely worth a premium upgrade.
| Security Measure | Free Option | When Premium Is Worth It |
|---|---|---|
| Firewall & malware scanning | Free tier of Wordfence, Sucuri, or Solid Security | E-commerce or client sites with sensitive data — faster response and cleanup guarantees matter |
| Backups | Free plugin with manual offsite storage setup | Sites that change daily; automated real-time backups reduce data loss window |
| SSL certificate | Free via Let's Encrypt (most hosts include this) | Rarely necessary to upgrade unless you need extended validation for enterprise trust badges |
| Hosting | Budget shared hosting with basic isolation | Managed WordPress hosting with built-in hardening, staging, and daily backups |
| Two-factor authentication | Free plugin using an authenticator app | Rarely necessary to pay — free 2FA is already strong protection |
Practical takeaway: A brand-new blog can run entirely on free tools and still be well protected. The moment a site starts generating meaningful revenue, handles customer data, or has been attacked once already, the calculation shifts and premium security tooling becomes a reasonable cost of doing business.
What to Do If Your Site Gets Hacked
Even with every precaution in place, no system is completely immune. If you notice unfamiliar admin accounts, strange redirects, unexpected pop-ups, or a warning from your browser or hosting provider, act quickly and methodically.
Do not panic, and do not delete anything yet. Acting too fast can destroy evidence you might need, or wipe out a backup you still needed to reference.
Step 1: Isolate the site. Put the site into maintenance mode or take it offline temporarily so visitors are not exposed to malicious content while you work.
Step 2: Contact your host. Many hosting providers have a security team that can confirm whether the compromise is isolated to your account or part of a broader server issue, and some offer free malware removal as part of your plan.
Step 3: Restore from a clean backup. If you have a backup from before the compromise, this is almost always faster and safer than trying to manually hunt down every injected file.
Step 4: Change every password. WordPress admin, hosting account, FTP/SFTP, and database passwords should all be reset, since you cannot be certain which credentials were exposed.
Step 5: Scan thoroughly before going live again. Run a full malware scan with your security plugin, and consider a second opinion scan from your hosting provider's tools. Bringing a site back online before it is actually clean often results in reinfection within days.
Step 6: Review how it happened. Check whether an outdated plugin, a weak password, or a missing firewall was the entry point, and close that specific gap before moving on. This is also the moment to implement any checklist item above that you had been putting off.
Keeping Your Site Secure Long-Term
Security is not a one-time project — it is an ongoing habit. Set a recurring weekly reminder to check for updates, review your security plugin's activity log, and confirm your backups actually completed successfully. Once a quarter, do a deeper audit: remove unused plugins, review user accounts, and confirm your SSL certificate has renewed automatically.
If you are also working on your site's search visibility, it is worth revisiting our permalink structure guide at the same time, since a clean, well-organized site tends to be easier to monitor for anything out of place — a broken or unfamiliar URL pattern is often one of the first visible signs something has changed without your knowledge.
Common WordPress Security Myths
A few persistent myths tend to give site owners a false sense of security, or push them toward the wrong priorities. Clearing these up helps you spend your time on what actually matters.
Myth: "My site is too small to be a target." Attackers rarely target sites individually. Automated bots scan enormous ranges of IP addresses and domains looking for known, unpatched vulnerabilities, regardless of how much traffic a site gets. A brand-new blog with an outdated plugin is just as visible to these scanners as a major publication.
Myth: "A security plugin alone is enough." A firewall and malware scanner catch a lot, but they cannot compensate for a weak password, an admin account still named "admin," or backups that were never actually tested. Security plugins are one layer in a stack, not a replacement for the rest of the checklist.
Myth: "Hosting doesn't matter if I have good plugins." Server-level protection catches threats before they ever reach WordPress itself, including attacks that target the server software rather than your site directly. Cheap, unmanaged shared hosting is a common reason otherwise well-configured sites still get compromised.
Myth: "If nothing looks wrong, the site is fine." Some of the most damaging compromises are invisible to a casual glance — hidden spam links injected into old posts, a backdoor file quietly waiting to be used later, or a site being used to send spam email without affecting how it looks to a normal visitor. Regular scans catch what a visual inspection misses.
Frequently Asked Questions
Is WordPress actually safe to use for a business website?
Yes. WordPress itself is maintained by a large open-source community that patches vulnerabilities quickly. Most security incidents happen because of outdated plugins, weak passwords, or cheap hosting — not because of WordPress core software. Following the checklist in this guide closes almost every common entry point attackers rely on.
Do I need a paid security plugin, or is a free one enough?
A free plugin like Wordfence or Sucuri covers the essentials: firewall protection, malware scanning, and login hardening. Paid tiers add faster scan schedules, premium firewall rule updates, and automated malware removal. For a small blog or portfolio site, the free version is usually enough. For an e-commerce store or client site handling sensitive data, the paid tier is worth the cost.
How often should I update WordPress, themes, and plugins?
Check for updates at least once a week, and apply security patches within 24 to 48 hours of release whenever possible. Many successful attacks target sites running outdated plugins with publicly documented vulnerabilities, so the gap between a patch being released and you installing it is the riskiest window.
What is the single most important step in this checklist?
If you can only do one thing today, set up automated offsite backups. Backups will not stop an attack, but they turn a potential disaster into a minor inconvenience. Every other step reduces the odds of being hacked; backups protect you when something still slips through.
Will security plugins slow down my website?
A well-configured security plugin adds a small amount of overhead, but the impact is usually negligible on decent hosting. Real-time malware scanning and full site scans can briefly increase server load, so it is best to schedule deep scans during low-traffic hours rather than running them constantly.
My site was hacked. Where do I start?
First, take the site offline or put it in maintenance mode, then contact your host to isolate the account. Restore from your most recent clean backup, change every password (WordPress, hosting, FTP, database), scan for leftover malicious files, and only bring the site back online once a full scan comes back clean. See the recovery section above for the full step-by-step process.
Final Thoughts
Securing a WordPress website is not about achieving some perfect, unhackable state — that does not exist for any platform. It is about stacking enough reasonable precautions that automated attacks move on to an easier target, and that if something does slip through, you can recover in minutes instead of losing your site entirely. Work through the fourteen steps above one at a time, starting with updates, passwords, and backups, and you will have already closed the gaps responsible for the overwhelming majority of real-world WordPress compromises.