WordPress Security Basics: How to Protect Your Site from Hackers
WordPress is the world’s most popular CMS — which also makes it the world’s most popular target for hackers. Outdated plugins, weak passwords, and unprotected login pages cause the vast majority of hacks. The good news: most attacks are preventable with basic security hygiene.
Why WordPress Sites Get Hacked
- Outdated software — 90%+ of hacked sites had outdated core, theme, or plugin versions
- Weak passwords — brute force attacks guess common passwords in seconds
- Vulnerable plugins — poorly coded plugins with known security holes
- No monitoring — many owners don’t know they’ve been hacked for weeks
1. Keep Everything Updated
This is the #1 security step. Every update patches known vulnerabilities. Enable auto-updates for WordPress core, plugins, and themes.
2. Use Strong, Unique Passwords
Use a password that’s at least 16 characters with a mix of letters, numbers, and symbols. Use a password manager like 1Password or Bitwarden to generate and store them. Every admin account needs a strong password.
3. Enable Two-Factor Authentication (2FA)
Even if your password is stolen, 2FA prevents login. Install:
- Wordfence Login Security — free, easy to set up
- WP 2FA — flexible, supports multiple methods
- Google Authenticator plugin — simple and reliable
4. Install a Security Plugin
- Wordfence — industry leader; firewall, malware scanner, brute force protection
- Sucuri Security — excellent malware scanning (paid version)
- iThemes Security — good all-rounder
See our full guide to the best WordPress security plugins.
5. Change the Default Login URL
The default login at /wp-admin is targeted by automated attacks. Use WPS Hide Login to change it to something custom.
6. Limit Login Attempts
Enable login attempt limiting in your security plugin to lock out IPs after 3–5 failed attempts.
7. Set Up Automatic Backups
Backups are your last line of defense. Set up daily automated backups stored off-site (Google Drive, Dropbox, Amazon S3).
- UpdraftPlus — free, reliable, supports major cloud storage
- BackupBuddy — premium with migration tools
- Jetpack Backup — real-time backups
Read our guide to the best WordPress backup plugins.
8. Use SSL (HTTPS)
SSL encrypts the connection between your site and visitors. It’s free with Let’s Encrypt and most hosts provide one-click SSL. Google also penalizes non-HTTPS sites in search rankings.
9. Use Reputable Hosting
Your host is your first line of defense. Look for server-level firewalls, malware scanning, DDoS protection, and isolated hosting. Managed hosts like SiteGround, WP Engine, and Kinsta include these.
Security Checklist
- WordPress core up to date
- All plugins updated
- Strong passwords on all accounts
- 2FA enabled on admin accounts
- Security plugin installed
- Login URL customized
- Login attempts limited
- Daily backups configured
- SSL/HTTPS enabled
Helpful resources: