WordPress powers more than 40% of all websites — and that popularity makes it a frequent target for hackers, brute-force attacks, and bots. The good news: most successful attacks exploit basic, preventable weaknesses.

This guide compiles the essential practices that keep a WordPress site safe, based on years of hands-on experience. Work through them in order — each one closes a real door attackers use.

1. Harden your login page

The login page is the most attacked part of any WordPress site. Lock it down:

1. Never use “admin” as a username. It’s the first thing every brute-force bot tries.
2. Use a strong, unique password — long, random, with uppercase, lowercase, numbers, and symbols. Use a password manager; don’t reuse passwords across sites.
3. Enable two-factor authentication (2FA) for every user account. The free WP 2FA plugin makes this straightforward.
4. Change the default login URL. Instead of the guessable /wp-admin/, use something only you know — the free WPS Hide Login plugin does this in one setting.
5. Add a CAPTCHA to the login form if 2FA isn’t an option for you — several free plugins offer this.
6. Log out idle users automatically with an inactive-logout plugin, so abandoned sessions don’t linger.

2. Keep PHP updated

WordPress runs on PHP, and outdated PHP versions contain known security vulnerabilities — as well as being slower. Each PHP release branch is supported for about two years; running anything past its end-of-life is asking for trouble.

Check your version under Tools → Site Health → Info → Server. Most hosts let you switch PHP versions from a dropdown in the hosting control panel. Update your plugins and theme first, switch the version, then test your site.

3. Keep WordPress, themes, and plugins updated

Every WordPress release patches bugs and security vulnerabilities found in earlier versions. The same goes for themes and plugins — in fact, vulnerable plugins are one of the most common ways sites get compromised.

• Apply updates promptly via Dashboard → Updates.
• Remove plugins and themes you don’t use — code you don’t run can’t be exploited.
• See our WordPress maintenance guide for a complete update and backup routine.

4. Use secure hosting

Good hosting is a security layer in itself. Look for a host that provides:

• Server-level firewalls and malware scanning
• Free SSL certificates
• Daily automatic backups
• Account isolation (so another customer’s compromised site can’t affect yours)
• Knowledgeable support that helps with security incidents

Cheap, overcrowded shared hosting is where the most compromised sites live.

5. Use SSL/HTTPS everywhere

SSL encrypts traffic between your visitors’ browsers and your server, protecting login credentials and any data your visitors submit. It’s also a Google ranking factor, and browsers now warn visitors away from non-HTTPS sites.

Most reputable hosts include a free SSL certificate (usually via Let’s Encrypt) — enable it and make sure your whole site loads over HTTPS, not just the homepage.

6. Install a security plugin

A dedicated security plugin adds firewall protection, malware scanning, and login attempt limiting:

• Wordfence Security — the most popular free firewall + scanner for WordPress.
• Sucuri Security — strong monitoring and hardening options.

Pick one, run its initial scan, and turn on email alerts so you hear about problems immediately.

7. Limit user access

Give every user the lowest role that lets them do their job — most contributors don’t need administrator access. Review your user list periodically under Users → All Users and remove accounts you don’t recognize or no longer need. Fewer privileged accounts means fewer ways in.

Ongoing: scan, back up, repeat

Security isn’t a one-time setup. Build these into a routine:

• Scan regularly with your security plugin and investigate anything suspicious.
• Back up automatically — daily database backups and weekly full backups, stored off-site (not just on your hosting account). If the worst happens, a clean backup is your fastest recovery.
• Stay informed — follow WordPress security news so you hear about major vulnerabilities early.

Combine this checklist with regular WordPress maintenance, and your site will be harder to crack than the vast majority of WordPress installations out there.

Disclosure: our content is reader-supported. This means if you click on some of our links, we may earn a commission at no extra cost to you.