To secure a WordPress website, keep WordPress, themes, plugins and PHP updated, protect admin accounts with strong passwords and two-factor authentication, remove unused plugins, take off-site backups, and add a web application firewall. Most hacked WordPress sites were running outdated plugins, not a flaw in WordPress itself. This checklist covers each step in order of impact.
Key takeaways
- Outdated plugins and themes are the most common way WordPress sites are hacked.
- Turn on automatic updates and remove plugins you do not use.
- Use two-factor authentication for every administrator account.
- Keep off-site backups so you can restore quickly if something goes wrong.
Why do WordPress websites get hacked?
WordPress websites usually get hacked through outdated plugins or themes, weak administrator passwords, and old PHP versions. Attackers use automated tools to scan millions of sites for known flaws and exploit any site that has not been updated.
We covered two real examples in our major cyberattacks guide: a critical flaw in a caching plugin used on more than five million sites, and a PHP flaw exploited for ransomware within days of disclosure.
How to secure a WordPress website: the checklist
Follow these ten steps. The first four stop the majority of automated attacks.
- Update everything: WordPress core, themes, plugins and PHP. Turn on automatic updates.
- Remove unused plugins and themes, including deactivated ones.
- Protect admin accounts with unique passwords and two-factor authentication.
- Take off-site backups daily, and test a restore.
- Limit administrators to the people who need full access; give writers the Author or Editor role.
- Add a web application firewall through your host, a CDN or a security plugin.
- Limit login attempts to slow down password guessing.
- Use HTTPS everywhere with a valid certificate.
- Disable file editing in the dashboard with
DISALLOW_FILE_EDIT. - Monitor for new admin users, changed files and unexpected redirects.
These match the official WordPress hardening guide.
Which WordPress attacks does each step block?
Each hardening step blocks a specific attack path. The table maps the most common WordPress attacks to the control that stops them.
| Attack | How it works | Control |
|---|---|---|
| Plugin exploit | Known flaw in an outdated plugin | Automatic updates; remove unused plugins |
| Brute-force login | Bots guess admin passwords | 2FA, login limits, unique passwords |
| Stolen admin password | Password reused from another breach | 2FA and a password manager |
| Malicious redirect or spam injection | Attacker edits files or the database | Firewall, file editing off, monitoring |
| Server-level flaw | Old PHP or server software | Supported PHP version, managed hosting |
How often should you update WordPress plugins?
Update WordPress plugins as soon as security releases are available, ideally automatically. Critical flaws in popular plugins are often exploited within days of disclosure, so waiting for a monthly maintenance window leaves your site exposed.
Watch the CISA Known Exploited Vulnerabilities catalog for software you run, and keep a staging copy if your site is complex enough that updates could break it.
What should you do if your WordPress site is hacked?
If your WordPress site is hacked, take it offline or into maintenance mode, change all passwords, restore from a clean backup, update everything, and then find how the attacker got in. Restoring without fixing the entry point usually leads to reinfection.
Check for unknown admin users, unfamiliar plugins and modified core files. Our guide to managed cloud backup explains how to keep restore points you can trust.
Frequently asked questions
Is WordPress itself insecure?
No. WordPress core is well maintained and patched quickly. Most compromises come from outdated plugins, themes, weak passwords or old server software, which are the site owner’s responsibility.
Do I need a WordPress security plugin?
A security plugin helps with login limits, file monitoring and a firewall, but it does not replace updates and backups. If your host or CDN already provides a firewall, a lighter plugin is enough.
How many plugins are too many?
There is no fixed number. What matters is that every plugin is needed, maintained by an active developer and kept updated. Remove anything abandoned or unused.
Which PHP version should my WordPress site use?
Use a PHP version that still receives security support from the PHP project. Ask your host to upgrade if you are on an end-of-life version, after testing your site on a staging copy.
Next steps
Securing a WordPress website is mostly about consistency: updates, two-factor authentication, fewer plugins and tested backups. Work through the checklist this week and turn on automatic updates. To check the rest of your business security, take the free Cybersecurity Readiness Assessment.
