WordPress powers a large share of the web, which also makes it a common target for automated attacks. The good news is that most protection comes from a handful of simple, consistent habits. Here is a practical checklist based on the official WordPress documentation.
1. Keep everything updated
Updates patch known vulnerabilities. WordPress recommends running the latest version and supports automatic updates.
- Turn on automatic core updates if your host allows it.
- Update plugins and themes regularly, ideally right after a backup.
- Check that your host runs a supported PHP version.
2. Strong passwords and two-step login
- Use a long, randomly generated password for every account and keep it in a password manager.
- Enable two-step authentication on every administrator account.
- Only give the Administrator role to people who truly need it, and remove accounts nobody uses.
3. Install only trusted plugins and themes
The official documentation advises sticking to the WordPress.org directory or well-known companies. “Free” copies of premium plugins from unknown sites (so-called nulled plugins) are a real risk because they can contain hidden code.
- Delete plugins and themes you don’t use instead of just deactivating them.
- Before installing a plugin, check when it was last updated and whether it supports your version.
4. Back up, and test your restores
Backups are your safety net. They should include both files and the database and be stored somewhere other than the site’s own server.
- Choose a schedule that matches how often your content changes.
- Restore a backup to a test environment from time to time. A backup you’ve never restored is only an assumption.
5. Settings that reduce the attack surface
- Disable the dashboard file editor by adding
define( 'DISALLOW_FILE_EDIT', true ); to wp-config.php.
- Serve the whole site over HTTPS, and use SFTP rather than FTP to transfer files.
- Restrict write permissions to the folders that need them, such as
uploads.
- Give the database user only the privileges it needs.
6. Monitor and be ready
- Watch for unfamiliar administrator accounts and files that change for no reason.
- Use the scanning tools your host provides, if any.
- Keep a short plan: who to call, where backups are, and how to change passwords quickly.
If you think your site has been hacked
- Don’t delete everything in a hurry: keep a copy of the current state for analysis.
- Change your hosting, WordPress and database passwords.
- Contact your host’s support and bring in a specialist if needed.
- After the clean-up, keep monitoring for a while to make sure the problem doesn’t return.
The bottom line
No site is bulletproof, but regular updates, strong passwords with two-step login, trusted plugins and tested backups cut the risk considerably. If you’d like your site’s setup reviewed, get in touch.
Sources
