Nobody thinks their small website will get hacked. But here’s the uncomfortable truth: attackers aren’t picking targets by hand. Automated bots scan every IP address on the internet every day, looking for any WordPress site with a known weakness — big or small.
And the numbers are sobering. Security researchers recorded 11,334 new WordPress vulnerabilities in 2025 — a 42% jump from the year before — and the weighted median time between a vulnerability being disclosed and the first mass exploitation attempt was just 5 hours (Patchstack 2026 WordPress Security Report). Meanwhile, Wordfence blocked over 18 billion attacks in the first half of 2025, with brute-force login attempts averaging 65 million per day.
The good news? The vast majority of hacks are preventable with basic hygiene. WordPress core itself is remarkably secure — it accounted for only about 1.1% of total vulnerabilities, while 91% came from plugins. That means your security comes down to a handful of simple habits, not technical wizardry.
This guide walks you through 7 beginner-friendly steps to lock down your WordPress site. No code required, and almost everything is free.
Quick Checklist: The 7 Steps
- Turn on automatic updates for WordPress, plugins, and themes
- Use a strong, unique login with two-factor authentication
- Install a free security plugin
- Set up automatic off-site backups
- Make sure your site runs on HTTPS (SSL)
- Delete plugins and themes you don’t use
- Choose a host that takes security seriously
Step 1: Keep Everything Updated (The #1 Thing)
Outdated software is the single most common way WordPress sites get hacked. 31% of hacked WordPress sites in 2025 were compromised through outdated plugins. One vulnerable plugin is all it takes.
The fix is simple, and most of it can be automatic:
- In your WordPress dashboard, go to Dashboard → Updates and install any pending updates right now.
- Go to Plugins → Installed Plugins, and enable auto-updates for every plugin you actively use.
- Go to Appearance → Themes and enable auto-updates for your active theme too.
- In Dashboard → Updates, make sure WordPress core auto-updates are enabled for minor security releases.
Important: always have a working backup before running major updates (see Step 4). Updates very rarely break things, but a backup means you can roll back in minutes if they do.
And if a plugin you rely on hasn’t been updated by its developer in over a year, consider replacing it — abandoned plugins are a favorite target.
Step 2: Harden Your Login
Your login page is the most attacked URL on your site. Bots hammer wp-login.php with stolen username/password combinations around the clock. Make their job impossible:
- Never use “admin” as your username. It’s the first thing bots try. If your account is still called “admin,” create a new Administrator user with a different name, log in as that user, and delete the old “admin” account.
- Use a long, unique password. At least 12 characters, mixed case, numbers, and symbols. Use a password manager (like Bitwarden, which is free) so you don’t have to remember it.
- Turn on two-factor authentication (2FA). This is the single highest-value login protection. Even if someone steals your password, they can’t log in without the code from your phone. Only 34% of WordPress admin accounts use 2FA today — be in the smarter third. (Both Wordfence and Solid Security, covered in Step 3, include free 2FA.)
- Give people the lowest role they need. Don’t hand out Administrator access to everyone who writes a post. Editors, Authors, and Shop Managers can do their jobs without admin rights.
Step 3: Install a Free Security Plugin
A good security plugin adds a firewall, malware scanning, and login protection in one package — no technical knowledge needed. For a beginner site, the free tier of either of these is plenty:
| Wordfence Security | Solid Security (formerly iThemes Security) | |
|---|---|---|
| Free plan | Yes — firewall + scanner included | Yes — most hardening features free |
| Best for | All-around protection, deep malware scanning | Lightweight hardening, easy 2FA setup |
| Firewall | Yes (endpoint WAF) | Basic rules only |
| 2FA | Yes | Yes |
| Paid plans from | ~$149/year | ~$99/year |
My honest take: start with Wordfence Free. It’s the most popular security plugin for a reason — the free firewall and scanner are genuinely strong, and it has over 5 million active installs. Solid Security is a lighter, simpler alternative if Wordfence feels overwhelming. Don’t pay for a premium plan until your site actually earns money; the free versions cover the threats a beginner site faces.
One rule: install only one security plugin. Two security plugins will fight each other and can break your site.
Step 4: Set Up Automatic Backups (Your Safety Net)
No security is perfect. Backups are what turn a disaster into a 10-minute inconvenience. If your site ever gets hacked, a clean backup lets you restore everything — posts, images, settings — in one click.
UpdraftPlus (free) is the go-to backup plugin for beginners:
- Install and activate UpdraftPlus from Plugins → Add New.
- Go to Settings → UpdraftPlus Backups → Settings.
- Choose a remote storage location — Google Drive or Dropbox (free) — and follow the prompts to connect it. Never store your only backup on the same server as your site; if the server goes down, both are gone.
- Set the schedule to daily for the database and weekly for files, and keep at least 2–3 recent backups.
- Run your first backup manually to confirm it works, and test restoring it once on a staging copy or local install.
One caution: backup plugins themselves can have vulnerabilities — in September 2026, a flaw in a popular backup plugin exposed over 3 million sites until patched. That’s not a reason to skip backups; it’s a reason to keep your backup plugin updated like everything else (Step 1).
Many quality hosts also include free daily backups. That’s a nice bonus, but keep your own off-site copy too — your host’s backup and your backup shouldn’t be the same thing.
Step 5: Use HTTPS (SSL) Everywhere
If your site’s address still starts with http:// instead of https://, your login credentials and visitors’ data travel unencrypted. Google also flags non-HTTPS sites as “Not secure,” which scares visitors away. HTTPS adoption among WordPress sites has reached 92.6% — there’s no reason to be in the remaining 7%.
The fix is easy: almost every reputable host offers a free Let’s Encrypt SSL certificate. Check your hosting control panel for an SSL/TLS section, enable it, and then make sure WordPress knows about it (Settings → General: both URLs should start with https://).
If you see “mixed content” warnings after switching, a plugin like Really Simple SSL can fix them automatically.
Step 6: Remove What You Don’t Use
Every installed plugin and theme is a potential entry point — even inactive ones can be exploited. Think of it as locking the doors of rooms you never enter:
- Go to Plugins → Installed Plugins and delete anything you don’t actively use. (Deactivating isn’t enough — delete them.)
- Go to Appearance → Themes and delete every theme except your active one and one default fallback theme (like Twenty Twenty-Four).
A lean site is a more secure site — and usually a faster one too.
Step 7: Choose a Host That Helps With Security
Your hosting company is your first line of defense. A good host provides server-level firewalls, malware scanning, and daily backups; a bad one leaves you on your own. When comparing hosts, look for:
- Free SSL certificates
- Server-level firewall and malware scanning
- Daily automatic backups with easy restore
- Up-to-date PHP versions (PHP 8.1+ as of 2026)
If you’re still shopping for hosting, our guide to the best WordPress hosting for beginners compares beginner-friendly options on exactly these criteria.
What To Do If Your Site Gets Hacked
Even with all of this, it’s worth knowing the drill. Signs of a hack include unexpected pop-ups or redirects, new admin users you didn’t create, a sudden traffic drop, or Google flagging your site as dangerous. If it happens:
- Don’t panic, and don’t try to “clean” it by hand unless you know what you’re doing — you’ll likely miss the backdoor that let them in.
- Restore from your clean backup (Step 4) — this is why you have one.
- Change every password: WordPress admins, hosting account, database, and FTP.
- Update everything to the latest versions, then run a full scan with Wordfence.
- Contact your host. Many hosts will help clean a hacked site, and some security companies offer one-time cleanup services (typically $80–$250).
If the hack keeps coming back after a restore, your backup itself may be infected — restore an older one, or get professional help.
Frequently Asked Questions
Is WordPress insecure?
No — WordPress core is very secure (only ~1% of vulnerabilities). The risk comes from plugins, themes, and poor maintenance. A maintained WordPress site with updated plugins is as safe as any other platform.
Do I need to pay for a security plugin?
For a new or small site, no. The free versions of Wordfence or Solid Security cover the essentials. Consider upgrading when your site generates revenue worth protecting.
Will a security plugin slow down my site?
Barely. Modern security plugins are lightweight, and Wordfence’s firewall runs before WordPress fully loads. The performance cost is negligible compared to the protection.
How do I know if my site has already been hacked?
Run a free scan with Wordfence or use an online scanner. Warning signs: unfamiliar admin users, strange redirects, sudden SEO spam in your search results, or your host suspending your account for sending spam.
Should I change my login URL?
It reduces bot noise in your logs, but it’s not real security — a determined attacker can find the login page anyway. Strong passwords + 2FA + a firewall matter far more.
The Bottom Line
Securing your WordPress site isn’t a one-time project — it’s a habit. But it’s a short habit: enable auto-updates, use 2FA, install Wordfence Free, set up UpdraftPlus backups to Google Drive, switch on HTTPS, and delete what you don’t use. That one afternoon of work blocks the overwhelming majority of attacks automated bots will ever throw at your site.
Security stats cited: Patchstack 2026 WordPress Security Report (11,334 vulnerabilities in 2025, 5-hour median disclosure-to-exploit); SQ Magazine WordPress Statistics 2026; TechCrunch, July 2026; TechTimes, September 2026.
