WordPress runs a huge share of the web, which makes it the most common target for hackers. Attackers now use automated tools that start hitting a new flaw within hours of it going public, long before most owners even hear about it. Fix those, and you shut the door on most threats.
Once these fixes become a routine, problems stop feeling like emergencies. A risky plugin gets flagged and fixed before anyone can use it. A stranger guessing password gets shut out while you sleep, and if something does slip through, you restore yesterday’s copy and get on with your day instead of rebuilding from scratch.
This read walks you through the steps that count the most for improving WordPress security. Each step tells you what to do and why it helps. At the end, you will find the security plugins worth using and a short checklist.
How Do You Keep WordPress, Plugins, and Themes Updated?
Most attacks succeed due to old plugins, weak passwords, and loose file settings. A few simple maintenance steps can help you close known security gaps, remove unnecessary files, and make it harder for attackers to exploit your site.
Start with the steps below to keep your WordPress installation up to date and reduce the chances of a preventable security breach.
Step 1: Update WordPress as Soon as Fixes Are Released
When a security fix comes out, the details of the flaw usually go public with it. This makes old versions easier to attack. Every day you delay an update – your site remains a known target.
Step 2: Turn On Automatic Updates
Start by turning on automatic updates. WordPress has supported them since version 3.7.
- Go to Dashboard > Updates and make sure core updates run on their own.
- Then open Plugins and click Enable “Auto-Updates” next to each plugin you trust.
- Do the same under Appearance > Themes.
Step 3: Remove Unused Plugins and Themes
Next, clean house which is removal of any unwanted data, outdated files, and unused code. Delete any plugin or theme you are not using. A deactivated plugin still sits on your server, and its files can still be attacked. Keep one default theme as a backup and remove the rest. This reduces the number of files attackers could target if a vulnerability is discovered.
Step 4: Install Add-Ons Only from Trusted Sources
Finally, only install add-ons from trusted places. Use the WordPress.org directory or well-known vendors. Never use “nulled” (pirated) plugins or themes, as they can contain malicious code that puts your site at risk.
How Do You Protect the WordPress Login Page?
Once your software is current, the next weak spot is the login screen. Bots hit wp-login.php all day, trying thousands of username and password pairs. This is called a brute force attack. The steps below make those guesses useless.
Use strong & unique passwords
Pick a long passphrase and store it in a password manager. Avoid names, dictionary words, and short passwords. WordPress shows a strength meter when you set a password, so aim for “Strong.”
Turn on two-factor authentication (2FA)
The free Two Factor plugin, maintained by WordPress contributors, works well. Make it required for every admin. Passkeys (Face ID, Windows Hello, or a security key) are an even stronger option if your plugin supports them.
Limit login attempts
Lock out an IP address after a few failed tries. Most security plugins do this. If your host or a service like Cloudflare can rate-limit the login page, that is better, because bad traffic gets blocked before it reaches your server.
Do not use “admin” as a username
It is the first name bots try. Create a new admin account with a unique name, log in with it, and delete the old one. WordPress will ask you to give the old account posts to the new user.
Disable XML-RPC if you do not need it.
The xmlrpc.php file lets outside apps talk to your site. Attackers use it to test many passwords in one request. If you do not use the WordPress mobile app or Jetpack, block it. On Apache, add this to .htaccess:
<Files "xmlrpc.php">
Require all denied
</Files>Does Hosting and Server Setup Matter?
Yes, a lot. Your host controls the ground your site stands on. If the server is old or poorly managed, your WordPress settings cannot fully protect you. On shared hosting, a hacked site next door can even affect yours.
Run a supported PHP version
WordPress.org recommends PHP 8.3 or newer, plus MariaDB 10.11+ or MySQL 8.0+. Older versions still work, but they no longer get security fixes. You can usually switch PHP versions in your hosting control panel in a few clicks. Test on a staging copy first.
Use HTTPS everywhere
WordPress.org now lists HTTPS as a basic requirement. An SSL certificate encrypts the link between your visitors and your site, so passwords cannot be read in transit. Most hosts offer free certificates from Let’s Encrypt. After you install one, update both URLs under Settings > General to start with https://.
Connect with SFTP Instead of FTP
FTP sends your password as a readable text. SFTP encrypts it. Ask your host for SFTP or SSH details and delete any old FTP accounts.
Set safe file permissions
Suggested is 755 for folders and 644 for files. Your wp-config.php file can be stricter, at 400 or 440, so only you and the server can read it. Never set anything to 777.
How Do You Harden WordPress Files With .htaccess and wp-config.php?
With the server in good shape, you can lock down key files. If your site runs on Apache or LiteSpeed, the .htaccess file lets you block access to places attackers love. Always download a copy of the file before you edit it. One typo can take your site offline, and the backup lets you undo it in seconds.
While some show Order allow,deny and Deny from all, the snippets below use modern Apache 2.4 syntax (Require all denied). This is Apache 2.2 syntax, and it only works on newer servers if a special module is turned on. Place your rules outside the # BEGIN WordPress and # END WordPress lines, because WordPress can overwrite anything between them.
Turn Off PHP in the Uploads Folder
The wp-content/uploads folder should only hold images, PDFs, and other media. It never needs to run PHP code. Yet attackers often sneak a PHP file in through a weak plugin, then run it to take over the site. Blocking PHP here stops that trick.
Create a new file named .htaccess inside wp-content/uploads and add the following:
<FilesMatch "\.(php|phtml|phar)$">
Require all denied
</FilesMatch>This also catches other PHP file types that attackers use to slip past simpler rules.
Protect Your wp-config.php File
Your wp-config.php file holds your database name, username, password, and secret keys. It is the most valuable file on your site. Protect it by adding this near the top of the main .htaccess file in your site’s root folder:
<Files "wp-config.php">
Require all denied
</Files>Block Direct Access to wp-includes
The wp-includes folder holds core scripts that visitors should never load directly. Here’s what the main .htaccess file needs to contain:
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^wp-admin/includes/ - [F,L]
RewriteRule !^wp-includes/ - [S=3]
RewriteRule ^wp-includes/[^/]+\.php$ - [F,L]
RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F,L]
RewriteRule ^wp-includes/theme-compat/ - [F,L]
</IfModule>If you run WordPress Multisite, leave out the line with [^/]+\.php$, as it can break image loading on Multisite.
Stop Directory Browsing
If a folder has no index file, some servers show a list of everything inside it. That hands attackers a map of your plugins and files. Add this one line to the main .htaccess file:
Options -IndexesDisable the Built-In File Editor
By default, admins can edit theme and plugin code from the dashboard. If a hacker gets into an admin account, this editor is the first tool they use. Turn it off by adding this line to wp-config.php, above the line that says “That’s all, stop editing!”:
define( 'DISALLOW_FILE_EDIT', true );Who Should Have Admin Access to Your Site?
As few people as possible. Every admin account is another door a hacker can try. If a writer only needs to publish posts, they do not need the power to install plugins. This idea is called “least privilege.”
Go to Users and review each account. Give each person the lowest role that lets them do their job. Authors can write and publish their own posts. Editors can manage everyone’s posts. Only owners and trusted developers should be Administrators.
Remove accounts that are no longer needed. That includes old staff, past freelancers, and test users. If a developer needs short-term access, create an account for the job and delete it when the work is done. For apps that connect to your site, use Application Passwords (under each user’s profile). You can cancel them at any time without changing the main password.
What Happens If Something Still Goes Wrong?
No setup is perfect, which is why backups are important. A good backup means a hack becomes a bad afternoon instead of a lost business.
- Back up both parts of your site: the files and the database. Run backups on a set schedule, daily for busy sites and weekly for quiet ones.
- Store copies away from your web server, such as Google Drive, Dropbox, or Amazon S3. A backup stored on the same server can be wiped in the same attack.
- Keep several older copies. A site hacked on May 1 might not be noticed until May 12. If you only keep the latest backup, it may already contain the malware. Older snapshots let you roll back to a clean point.
- Last, test a restore every few months. Many people find out their backups are broken only when they need them. A quick test on a staging site gives you peace of mind.
Which WordPress Security Plugins Should You Use?
A good security plugin handles many of the steps above one screen. It can add a firewall, scan for malware, limit logins, and alert you to risky plugins. A strong setup for most sites includes one security plugin (Wordfence or Solid Security), Patchstack for plugin alerts, Two Factor if your security plugin lacks 2FA, and UpdraftPlus for backups.
| Plugin | Best for | What it does well | Free version |
|---|---|---|---|
| Wordfence Security | All-in-one protection | Firewall, malware scanner, login limits, and 2FA in one plugin | Yes (new rules arrive 30 days later than paid) |
| Solid Security | Easy setup | Login security, and 2FA – paid plan adds virtual patching | Yes |
| Patchstack | Plugin flaw alerts | Warns you about vulnerable plugins – paid plan blocks attacks before a fix exists | Yes (alerts only) |
| Sucuri Security | Monitoring and cleanup | Activity logs, file checks, and an optional cloud firewall | Yes (firewall is paid) |
| All-In-One Security (AIOS) | Beginners on a budget | Login limits, file protection, and .htaccess rules from simple settings | Yes |
| Two Factor | Lightweight 2FA | Adds app codes, email codes, and security keys to logins | Yes |
| UpdraftPlus | Backups | Scheduled backups to cloud storage with one-click restore | Yes |
What Should You Do If Your Site Gets Hacked?
Act fast and stay calm. Signs of a hack include strange redirects, new admin users you did not create, spam pages in Google results, or a warning from your host. Follow these steps in order:
- Put the site in maintenance mode or ask your host to take it offline for a short time.
- Change every password of WordPress admins, hosting, SFTP, and the database.
- Run a full malware scan with your security plugin.
- Restore a clean backup from before the hack or have a professional clean the site.
- Update everything, then find and fix the weak point that lets the attacker in.
- Generate new secret keys for wp-config.php using the official salt generator. This logs out every user, including the attacker.
Quick WordPress Security Checklist
Use this list as a quick health check for your site. Go through it once now and tick off each item you have already done. Any empty box shows you exactly where to start. Then come back every few months, or whenever you add a new plugin or team member, because a site that passed the check in spring can quietly fall behind by fall.
- Auto-updates on for core, plugins, and themes
- Unused plugins and themes deleted
- Strong passwords and 2FA for every admin
- Login attempts limited and XML-RPC blocked if unused
- PHP 8.3 or newer and HTTPS active
- PHP blocked in the uploads folder
- wp-config.php protected and file editor disabled
- Directory browsing turned off
- Users set to the lowest role they need
- One security plugin installed and set up
- Off-site backups running and tested
Final Thoughts
You can see that a safe WordPress site is not built on one big defense. It is built in layers, and each layer is simple on its own. None of the steps in this read needs deep technical skills. Most take a few minutes, and many keep working by themselves once you switch them on.
Know that the real strength comes from using them together, so if one layer fails, the next one still holds. WordPress security is not a one-time job. It is a habit. Adapting to that habit will prevent automated attacks.
Each step in this read removes one of those easy openings. All you have to do is start with the basics today. Turn on updates, add 2FA, and set up backups. With 2FA, a stolen password is not enough, because the user also needs a code from their phone. WordPress does not include this by default, so you add it with a plugin. Afterwards, work through the file hardening steps when you have an hour to spare.
A little effort now saves you from a long and costly cleanup later.