WordPress’s popularity — powering roughly 43% of all websites — is exactly why it’s such a common target. Most successful attacks aren’t sophisticated; they exploit basic, preventable weaknesses: weak passwords, outdated plugins, and missing security layers. This guide covers the practical steps that address those weaknesses directly, building on the hosting-level protections covered in our reliable hosting guide.

Step 1: Use a Strong, Unique Admin Username

Never use “admin” as your username — it’s the first thing automated attacks try. When you install WordPress, set a unique username unrelated to your site name or email address, and pair it with a genuinely strong, unique password stored in a password manager rather than memorized or reused.

Step 2: Enable Two-Factor Authentication

Two-factor authentication (2FA) requires a second verification step — typically a code from your phone — beyond your password alone. Plugins like Wordfence or WP 2FA add this in a few minutes of setup, and it single-handedly blocks the vast majority of automated login attacks even if your password were somehow compromised.

Step 3: Keep WordPress, Themes, and Plugins Updated

The majority of WordPress hacks exploit known vulnerabilities in outdated software — vulnerabilities that were already patched in a newer version. Enable automatic updates for minor WordPress releases, and check your plugins and theme for updates at least weekly. An outdated plugin is one of the most common entry points for attackers.

Step 4: Install a Security Plugin

A dedicated security plugin like Wordfence or Sucuri adds a firewall layer specific to WordPress, scans your files for unauthorized changes, and limits login attempts to block brute-force attacks. This complements — not replaces — whatever security your host provides at the server level.

Step 5: Limit Login Attempts

Without a limit, an attacker can attempt unlimited password guesses against your login page. Most security plugins include this feature by default — after a handful of failed attempts, the IP address gets temporarily blocked, effectively shutting down brute-force attacks.

Step 6: Keep Independent Backups

Even with strong prevention, having a genuine backup — separate from whatever your host provides — means a worst-case scenario is recoverable rather than catastrophic. UpdraftPlus’s free tier handles scheduled backups to Google Drive or Dropbox, giving you a copy that exists entirely outside your hosting account.

Step 7: Remove Unused Plugins and Themes Entirely

A deactivated plugin still sits on your server as a potential vulnerability if it’s outdated. If you’re not actively using a plugin or theme, delete it rather than just deactivating it — fewer installed components means a smaller attack surface overall.

Warning Signs Your Site May Be Compromised

• Unexpected changes to your homepage or content you didn’t make
• New admin users you don’t recognize in your Users list
• Your site flagged by Google as “This site may be hacked” in search results
• Unusually slow performance or unexpected traffic spikes to unfamiliar pages
• Your hosting provider notifying you of malware detected on your account

Frequently Asked Questions