WordPress is the most common way to run a website, which makes it the most common target. Attackers use automated tools that scan thousands of sites a day for old plugins, reused passwords and forgotten admin accounts. Most break-ins use a weakness that already had a fix. This guide sets out a short routine that closes most of those gaps and a plan for the day something still goes wrong.
Keep core, plugins and themes up to date
WordPress installs its own minor and security releases automatically. You can also let it install major versions: go to Dashboard, then Updates, and turn on automatic updates for all new versions.
Plugins and themes have had their own auto-update switch since WordPress 5.5. On the Plugins screen each plugin has an "Enable auto-updates" link, and the Themes screen has the same option. Turn it on for every plugin you trust. If a plugin auto-update causes a fatal error on the home page, WordPress puts the old version back and e-mails you.
- Delete what you do not use. A deactivated plugin is still on the server and can still be attacked. Keep one default theme as a fallback and remove the rest.
- Check a plugin before you install it. Look at when it was last updated, how many sites use it and whether the author answers support questions. If a plugin is closed on WordPress.org, replace it.
- Run Site Health. Tools, then Site Health, flags an old PHP version, missing updates and other weak spots.
Fewer admins, smaller roles
Give every person their own account with the smallest role that lets them do their job. This is called least privilege. WordPress has five main roles: Administrator, Editor, Author, Contributor and Subscriber. Someone who writes posts needs Author or Contributor. Someone who manages other people's content needs Editor. Very few people need Administrator.
- Never share one login between several people. You lose track of who did what, and you cannot remove one person without locking out everyone.
- When a developer or agency finishes a job, remove their account or lower its role.
- Review the Users screen every few months and delete accounts nobody uses.
- Check Application Passwords on each admin profile and revoke any you do not recognise.
Strong logins: passwords, two-factor and passkeys
Use a password manager and give every account a long, unique password. A password reused from another site is one of the most common ways in.
Then add a second step. WordPress core does not include two-factor sign-in yet, so you add it with a plugin. The Two Factor plugin is maintained by WordPress contributors, and most security plugins include their own version. Codes from an authenticator app are stronger than codes sent by text message.
Passkeys go further. You sign in with your fingerprint, your face or your device PIN, and there is no password to steal. A passkey only works on the real site, so a fake login page cannot capture it. Several plugins add passkey sign-in to WordPress. Turn it on for administrator accounts first.
Backups you have tested
A backup is what turns a disaster into an inconvenience. A good backup routine has four parts:
- It copies both the files and the database.
- It runs automatically, at least daily for a site that changes every day.
- It stores copies away from the server, with several days or weeks of history.
- You have restored from it at least once, to a staging copy, so you know it works.
Keep at least one copy where the website cannot delete it. An attacker with admin access can wipe backups stored inside the same account. Take a fresh backup before any large update.
Hosting basics
- HTTPS on every page. Free certificates from Let's Encrypt are standard with most hosts.
- A supported PHP version. Old PHP versions stop getting security fixes. Your hosting control panel shows which one you run.
- Sites kept apart. If you run several sites on one hosting account, one hacked site can infect the others. Separate accounts or users stop that.
- SFTP, never plain FTP. Plain FTP sends your password unencrypted.
- No file editing from the dashboard. Add
define('DISALLOW_FILE_EDIT', true);towp-config.phpso a stolen admin login cannot edit theme or plugin code. - A firewall in front. Many hosts and content delivery networks filter common attacks before they reach WordPress.
What to do after a hack
Signs include pages you did not write, redirects to strange sites, new admin users, a warning in Google or a note from your host. Work through these steps in order.
- Contain it. Put the site in maintenance mode or ask your host to take it offline. Save a copy of the hacked site for investigation before you change anything.
- Lock the attacker out. Change the passwords for every WordPress admin, the hosting panel, SFTP, the database and any e-mail account linked to the site. Replace the security keys in
wp-config.php, which signs everyone out. - Clean or restore. Restore a backup from before the hack. If you do not have one, reinstall WordPress, every plugin and every theme from fresh copies, and check the uploads folder and the database for anything you did not add. PHP files in the uploads folder are a common sign.
- Close the hole. Find how they got in: an outdated plugin, a stolen password, a weak hosting setup. Fix it, or they will come back.
- Watch. Check the Security issues report in Google Search Console and request a review once the site is clean. If personal data may have been exposed, you may have to report it. Our GDPR guide for small websites explains the 72-hour rule.
Common questions
- Do I need a security plugin?
- One good security plugin helps with login protection, a firewall and malware scans. It does not replace updates and backups. Use one, since two can conflict.
- Will auto-updates break my site?
- Occasionally an update causes a problem. Daily backups and a staging copy make that a short fix, and WordPress rolls back a plugin auto-update that crashes the home page. An outdated plugin is the bigger risk.
- How often should I back up?
- As often as your content changes. For a shop or a site with daily posts or orders, that means every day.
- Is WordPress itself unsafe?
- WordPress core has a dedicated security team and gets fixes quickly. Most hacked sites were running outdated plugins, weak passwords or poorly set-up hosting.
Security is a routine you repeat, and an hour a month covers most of it. If you would rather hand it over, a professional on Internetivo can set up updates, backups and two-factor sign-in for you. Here is how your first project works.