WordPress powers over 40% of websites globally, which makes it the biggest target for hackers. The good news is that WordPress itself is secure — most breaches happen because of poor configuration, outdated plugins, and weak passwords.
These 10 tips will protect your WordPress site from the vast majority of attacks.
1. Keep WordPress Updated
WordPress releases security updates regularly. When you see an update notification, apply it.
- Update WordPress core as soon as minor releases are available
- Test major releases on a staging site first
- Enable automatic updates for minor versions
Most hacked WordPress sites were running outdated versions with known vulnerabilities.
2. Keep Plugins and Themes Updated
Outdated plugins are the number one way WordPress sites get compromised. Hackers scan the internet for sites running plugins with known vulnerabilities.
- Update plugins weekly
- Delete plugins you are not using (inactive plugins are still attack vectors)
- Only install plugins from the WordPress repository or reputable developers
- Check when a plugin was last updated before installing — avoid plugins not updated in over 6 months
3. Use Strong Passwords
Weak passwords are still a leading cause of breaches. For your WordPress admin account:
- Use 16+ characters with a mix of letters, numbers, and symbols
- Never use “admin” as the username
- Use a password manager to generate and store unique passwords
- Change passwords if you suspect a breach
Also ensure your hosting control panel, FTP, and database passwords are strong.
4. Install a Security Plugin
A good security plugin handles many protections automatically:
Wordfence (free and premium):
- Firewall that blocks malicious traffic
- Malware scanner
- Login security (limit attempts, two-factor authentication)
- Real-time threat intelligence
Sucuri Security (free and premium):
- Security activity auditing
- File integrity monitoring
- Remote malware scanning
- Post-hack security actions
Install one and configure it properly. The default settings are a good start.
5. Enable Two-Factor Authentication (2FA)
Even with a strong password, 2FA adds a second layer of security. A hacker needs both your password and your phone to log in.
- Use a plugin like Wordfence Login Security or Google Authenticator
- Enable 2FA for all admin accounts
- Use an authenticator app (not SMS) for better security
6. Limit Login Attempts
By default, WordPress allows unlimited login attempts. This makes brute-force attacks (trying thousands of password combinations) possible.
- Install a plugin to limit login attempts (Wordfence does this)
- Block IP addresses after 5-10 failed attempts
- Add a CAPTCHA to the login page
7. Use SSL/HTTPS
Your entire WordPress site should run on HTTPS. This encrypts data between your visitors and your server.
- Install a free SSL certificate (Let’s Encrypt)
- Update WordPress URL settings to use https://
- Force HTTPS redirect in your .htaccess file
- Install the “Really Simple SSL” plugin to handle mixed content
8. Change the Default Login URL
The default WordPress login page is at /wp-admin or /wp-login.php. Hackers know this and target it directly.
- Use a plugin like WPS Hide Login to change the login URL to something custom
- This stops most automated brute-force attacks
9. Regular Backups
If something goes wrong, a backup is your recovery plan.
- Use a plugin like UpdraftPlus or BlogVault
- Back up both files and database
- Store backups offsite (Google Drive, Dropbox, or S3)
- Test restoring from backup at least once
- Schedule daily or weekly backups depending on how often your content changes
10. Choose Secure Hosting
Your hosting provider is the foundation of your security. Cheap shared hosting often has weaker security, slower response to incidents, and no malware scanning.
Look for hosting that includes:
- Web Application Firewall (WAF)
- Malware scanning and removal
- Automatic backups
- SSL certificate
- PHP 8.0+ (older PHP versions have known vulnerabilities)
- Server-level security hardening
What to Do If Your Site Gets Hacked
- Stay calm — do not panic-delete files
- Scan — use Wordfence or Sucuri to identify malicious files
- Clean — remove malicious code or restore from a clean backup
- Update — change all passwords (WordPress admin, hosting, FTP, database)
- Patch — update WordPress, all plugins, and themes
- Harden — implement the tips above to prevent recurrence
- Request review — if Google flagged your site, request a review in Search Console after cleaning
Get WordPress Security Help
If your WordPress site needs a security audit or you have been hacked, contact 24Bit System. We provide WordPress security hardening, malware removal, and ongoing maintenance.
