WordPress Security Best Practices
How to Protect Your Site Before Something Goes Wrong
WordPress powers over 40% of the web. That popularity comes with a downside: it also makes WordPress the most targeted CMS on the internet. Attackers don't need to know anything about your specific site — they run automated scripts that scan for known vulnerabilities across millions of sites at once.
The good news is that most successful attacks are preventable. They exploit outdated software, weak passwords, and misconfigured settings — problems that have straightforward fixes. Keeping this guide's security practices in place is something every WordPress site owner should do in order to safeguard their site.
#1
Keep Everything Updated
The single most effective thing you can do for WordPress security is keep your core installation, themes, and plugins current. The majority of successful WordPress attacks exploit known vulnerabilities that have already been patched — in software that simply wasn't updated.
Enable automatic updates for minor core releases at a minimum. For plugins and themes, review updates regularly and apply them promptly. If a plugin hasn't been updated by its developer in over a year, treat it as a risk and look for an actively maintained alternative.
Delete anything you're not using. Inactive plugins and themes still represent attack surface even when disabled.
#2
Use Strong, Unique Credentials
Weak passwords and reused credentials are responsible for a significant share of WordPress compromises. Every account associated with your site — WordPress admin, hosting panel, FTP, and database — should have a long, unique password that isn't used anywhere else.
Use a password manager to generate and store credentials rather than relying on memory. Change the default admin username from "admin" to something less predictable. Attackers run brute-force scripts that specifically target the admin account because it's the default on every WordPress install.
Assign the lowest permission level that lets each user do their job. Editors don't need admin access. Contributors don't need editor access. Limiting roles limits the damage if an account is ever compromised.
#3
Enable Two-Factor Authentication
Passwords alone aren't enough for high-privilege accounts. Two-factor authentication (2FA) adds a second verification step — typically a time-based code from an app like Google Authenticator or Authy. And that makes stolen passwords far less useful to an attacker.
Enable 2FA for all administrator and editor accounts at minimum. Plugins like WP 2FA or the Wordfence Security plugin make this straightforward to set up without technical expertise.
#4
Install a Security Plugin
A dedicated security plugin handles several protective layers in one place. Look for one that offers login protection, malware scanning, firewall rules, and activity logging.
Well-regarded options include Wordfence, Sucuri Security, and iThemes Security.
Each takes a slightly different approach, but any of them is significantly better than nothing. At a minimum, configure login attempt limits to block brute-force attacks, and set up email alerts for suspicious activity so you know when something unusual happens.
#5
Harden Your Login Page
The WordPress login page at /wp-login.php is one of the most targeted URLs on the internet because it's identical on every default installation. A few changes meaningfully reduce automated attacks.
Limit login attempts to lock out IPs after a set number of failed tries. Consider changing the login URL to something non-default — not a silver bullet, but it eliminates the lowest-effort automated scans. If your site has a small, known group of admins, restrict login page access by IP address entirely.
Disable XML-RPC if you don't need it. This older WordPress feature is frequently exploited for brute-force attacks and can be turned off without affecting most modern sites.
#6
Keep Backups You Can Actually Restore
Backups are your safety net when everything else fails. They won't prevent an attack, but they determine how quickly and completely you can recover from one.
Automate daily backups of both your site files and your database. Store copies in at least two locations — your hosting server and an offsite destination like Amazon S3, Dropbox, or Google Drive. On-server-only backups don't help if the server itself is compromised.
Test your backups periodically by actually restoring from one. A backup you've never verified is a backup you can't trust.
#7
Enforce HTTPS Across the Entire Site
If your site is still running on HTTP, fix this immediately. HTTPS encrypts data in transit between your site and your visitors, prevents eavesdropping on form submissions, and is a ranking signal in Google Search.
Most hosting providers offer free SSL certificates through Let's Encrypt. Once your certificate is installed, redirect all HTTP traffic to HTTPS and set the HSTS header (HTTP Strict Transport Security - tells the browser to connect over HTTPS) to prevent browsers from ever falling back to an insecure connection. Use a plugin like Really Simple SSL if you need help with the redirect configuration.
#8
Control File Permissions
Incorrect file permissions are a common entry point for attackers who have already gained a foothold. As a general rule: WordPress files should be set to 644 and directories to 755. The wp-config.php file — which contains your database credentials — should be set to 600 or 640.
Prevent PHP execution in directories where it doesn't belong, such as your uploads folder. This stops a common attack pattern where malicious files are uploaded through a form vulnerability and then executed remotely. See this link for more information - https://patchstack.com/articles/disable-php-execution-directory-browsing/
#9
Choose Secure Hosting
Your security is only as strong as the platform you're running on. Look for a hosting provider that offers server-level firewalls, automatic malware scanning, isolated hosting environments (so a compromised site on a shared server doesn't affect yours), and a team that takes security reports seriously.
Managed WordPress hosting from providers like WP Engine, Kinsta, or Pressable includes security hardening, automatic updates, and faster support response when something goes wrong. The premium over basic shared hosting is usually worth it for any site that handles sensitive data or business-critical functions.
#10
Monitor Your Site
You can't respond to something you don't know about. Set up monitoring that alerts you when:
- Your site goes down
- A new admin account is created
- Core files are modified unexpectedly
- Your domain appears on a malware blacklist
Most security plugins include activity logs and alert systems. Google Search Console will also notify you if Google detects malware on your site — make sure it's verified and that alerts are going to an inbox you actually check.
WordPress Security - Summing it Up
No single security measure is foolproof, and no site is completely immune to attack. The goal isn't perfection — it's making your site a harder target than the next one.
Automated attacks move on quickly when they encounter resistance.
The practices in this guide aren't complicated or expensive. Most of them take less than an hour to implement. The ones that cost you time now will cost you far less than recovering from a compromised site later.
Set it up right, keep it maintained, and back up everything.