WordPress is used by millions of websites, which also makes it a common target for attackers. Most attacks are automated. Bots search the internet looking for outdated WordPress installations, vulnerable plugins, weak passwords, and other easy ways into a website.
The good news is that you do not need to be a security expert to make your WordPress site safer. A few basic steps can prevent many common attacks and infections.
Keep WordPress Updated
One of the most important things you can do is keep WordPress up to date.
WordPress updates often include security fixes. If a security problem becomes publicly known, attackers may begin searching for websites that have not installed the update.
You should keep all of these updated:
- WordPress itself
- Plugins
- Themes
WordPress can automatically install many updates. You can manage automatic updates from your WordPress dashboard or through WordPress management tools provided by your hosting control panel.
Keep Your Plugins Updated
Plugins add features to WordPress, but they are also one of the most common ways attackers get into outdated websites.
A plugin may have a security problem that allows an attacker to upload files, create an administrator account, change website content, or perform other unwanted actions.
When a plugin developer releases a security update, install it as soon as possible.
If a plugin has not received updates for a long time, consider replacing it with one that is actively maintained.
Remove Plugins You Do Not Use
Disabling a plugin does not necessarily remove its files from your website.
If an old plugin contains a security problem, those files may still be targeted even when the plugin is inactive.
If you no longer need a plugin, it is better to completely remove it.
The same applies to unused themes. Keep the theme you currently use and any backup theme you need, but remove old themes that serve no purpose.
Only Download Plugins and Themes From Trusted Sources
Be careful where you download WordPress plugins and themes.
A paid plugin or theme offered for free by an unknown website may have been modified to include malicious code. These are sometimes called nulled plugins or themes.
The software may appear to work normally while secretly creating administrator accounts, sending spam, redirecting visitors, or giving someone remote access to your website.
For free plugins and themes, the official WordPress directory is generally the safest place to start.
Use Strong Passwords
A weak password can allow an attacker to access your WordPress dashboard without needing to find a software vulnerability.
Avoid passwords such as:
- password123
- admin123
- yourcompany2026
Instead, use a long and unique password that you do not use anywhere else.
Your WordPress password should be different from your email, hosting control panel, FTP, and other passwords.
A password manager can make it easier to create and store strong passwords.
Do Not Share Administrator Accounts
Each person who manages your website should have their own WordPress account.
Do not have several people share the same administrator username and password.
Separate accounts make it easier to remove someone's access later and help you identify which account made a change.
You should also only give users the permissions they actually need. Someone who only writes articles usually does not need full administrator access.
Use Two-Factor Authentication
Two-factor authentication, often called 2FA, adds another security check when you log in.
Normally, logging in only requires your username and password. With 2FA enabled, you also provide a temporary code, usually generated by an authentication app.
This can help protect your website even if someone discovers your password.
There are free WordPress plugins available that can add two-factor authentication to WordPress.
Protect Against Repeated Login Attempts
Bots regularly try to guess WordPress usernames and passwords. This is known as a brute-force attack.
A bot may try hundreds or thousands of password combinations until it finds one that works.
Free WordPress security plugins are available that can limit repeated login attempts or temporarily block an IP address after too many failed logins.
This does not replace a strong password, but it can provide another layer of protection.
Delete WordPress Accounts You No Longer Need
Old user accounts are easy to forget. If an employee, developer, designer, or other person no longer needs access to your website, remove their account or reduce its permissions.
This is especially important for accounts with the Administrator role.
You should occasionally review the Users section of WordPress and make sure you recognize every administrator account.
If you find an administrator account you did not create, investigate it immediately.
Keep Your Computer Secure Too
Your website can be secure while your own computer is not.
Malware on a computer can steal saved passwords for WordPress, FTP, email, or your hosting control panel.
Keep your computer and web browser updated and use the security protections included with your operating system.
Avoid saving important passwords on computers you do not control.
Use HTTPS
Your WordPress website should use HTTPS.
HTTPS encrypts information traveling between your visitors and your website. You can recognize it by the https:// at the beginning of a website address.
HTTPS is especially important for login pages because it helps protect usernames, passwords, and other information while they travel across the internet.
Our Web Hosting includes SSL certificates that can be used to enable HTTPS for your website.
Make Regular Backups
Backups do not stop an attack, but they can make recovering from one much easier.
If an attacker damages your website or malware changes hundreds of files, restoring a clean backup may be much faster than repairing every file individually.
Make sure your backups include both:
- Your WordPress files
- Your WordPress database
A backup should also be from before the infection occurred. Restoring a backup that already contains the malware can bring the infection right back.
Be Careful With File Permissions
WordPress files and folders need the correct permissions so the web server can access them.
Making everything writable by everyone can create unnecessary security risks.
You should never use permissions such as 777 to make WordPress work.
If a plugin or theme tells you to make files completely writable, find out why before making the change.
Protect Your Contact Forms
Contact forms can be abused by automated bots.
Bots may repeatedly submit forms, send unwanted messages, or attempt to use poorly designed forms to send spam.
Adding CAPTCHA or another anti-spam feature can help.
Several WordPress form and security plugins provide free anti-spam or CAPTCHA options.
Do Not Ignore WordPress Security Warnings
If WordPress, your hosting control panel, or a security tool reports that a plugin contains a known vulnerability, take the warning seriously.
Update the plugin if a fixed version is available. If no fix is available, disabling and removing the vulnerable plugin may be the safest choice until the developer releases an update.
Watch for Signs That Your Website Has Been Compromised
A hacked WordPress website does not always stop working.
Sometimes the first signs are small.
You might notice:
- New administrator accounts you did not create
- Strange files in your website directories
- Visitors being redirected to another website
- Spam pages appearing in search engines
- Unexpected changes to your website
- Plugins appearing that you did not install
- Large amounts of email being sent from the website
- Security warnings from your browser or search engines
If something does not look right, investigate it rather than assuming it is harmless.
What Should I Do If My WordPress Site Is Infected?
If you believe your WordPress website has been compromised, changing your password alone is usually not enough.
The attacker may have uploaded malicious files or created another way to access the website.
You should change your WordPress administrator passwords, review administrator accounts, update WordPress and its plugins and themes, and look for suspicious files or changes.
You should also change related passwords, such as your hosting, FTP, and database passwords, when appropriate.
If you have a known clean backup from before the infection, restoring it may be an option. After restoring the backup, immediately update WordPress, plugins, and themes so the same vulnerability cannot simply be used again.
Will a Security Plugin Completely Protect WordPress?
No. Security plugins can be helpful, and there are good free options available, but no plugin can guarantee that a website will never be compromised.
A security plugin works best as one part of your overall security.
Keeping WordPress updated, removing unused software, using strong passwords, protecting administrator accounts, and maintaining backups are just as important.
Do I Need to Be a Security Expert?
No. For most WordPress websites, basic maintenance makes a big difference.
Keep WordPress, themes, and plugins updated. Remove software you do not use. Use strong and unique passwords. Enable two-factor authentication when possible. Keep backups and pay attention when something unusual happens.
WordPress security is not something you set up once and forget about. Keeping your website secure is an ongoing part of maintaining it.
Following these basic practices can greatly reduce the chances of your WordPress website becoming infected or being taken over by an attacker.
