How to Secure a WordPress Site: Practical Security Steps

If you run a WordPress site, you’ve probably read the scary numbers: thousands get hacked every day. But most of those attacks are preventable with a handful of straightforward habits.

New vulnerabilities in 2024: 7,966 (Patchstack) ·
Share in plugins: 96% (Patchstack) ·
Automatic updates since: WordPress 3.7 (WordPress.org Developer Resources)

The following table distills essential security measures and their documented impact, drawn from official sources.

How to make a WordPress site secure?

Use strong passwords and two-factor authentication

• Weak passwords are the second most common entry vector. Enforce a password policy with minimum 12 characters and a mix of letters, numbers, and symbols.
• Two-factor authentication (2FA) adds a second factor (SMS code, authenticator app) that blocks 99.9% of automated brute-force attacks (Cloudflare).
• Plugins like Wordfence and WP 2FA make setup straightforward.

Keep WordPress core, themes, and plugins updated

• WordPress.org’s developer handbook calls updates “the most important security measure you can take” (WordPress.org Developer Resources).
• Outdated software is the root cause of 96% of plugin-related vulnerabilities (Patchstack).
• Enable automatic updates for minor releases; use a staging environment for major version updates.

Install a reputable security plugin (Wordfence, Sucuri)

• Security plugins provide firewall, malware scanning, and login activity logs. Wordfence’s free tier includes a web application firewall and real-time threat intelligence.
• Sucuri offers a cloud-based firewall with DDoS protection and signature-based malware detection (Sucuri Research Team, 2024).
• Both integrate with email alerts so you’re notified of suspicious activity.

Enable HTTPS with a free SSL certificate (Let’s Encrypt)

• HTTPS encrypts all data between visitors and your server, preventing man-in-the-middle attacks and credential theft (Cloudflare).
• Let’s Encrypt offers free, automated SSL certificates that renew every 90 days; most hosting providers include one-click activation.
• Ensure all internal links (CSS, JS, images) are served over HTTPS to avoid mixed-content warnings.

Limit login attempts and change default admin username

• Limit login attempts using a plugin or server-level configuration to lock out IPs after 3–5 failed attempts (Cloudflare).
• Change the default “admin” username to reduce brute-force targeting. WordPress.org warns against using the default administrator account (WordPress.org Developer Resources).

The implication: By automating updates, enforcing 2FA, and using a security plugin, site owners remove the three most exploited attack vectors.

Are WordPress sites secure?

WordPress itself is secure when properly maintained

• WordPress core undergoes rigorous code review and security research. The official security team coordinates responsible disclosure and releases patches quickly.
• Automatic updates have been supported since version 3.7, making it easy to stay current with security fixes (WordPress.org Developer Resources).

Most vulnerabilities come from third-party plugins and themes

• Patchstack’s 2025 report found that 96% of vulnerabilities in the WordPress ecosystem were in plugins; only 4% were in themes (Patchstack).
• Plugins from untrusted sources or those no longer receiving updates act as open doors.
• Use only plugins listed in the official WordPress Plugin Directory or from reputable developers.

Regular updates and good hosting mitigate risks

• Managed WordPress hosts (e.g., WP Engine, Kinsta) apply server-level firewall rules, malware scanning, and automatic backup retention.
• Cloudflare’s guidance includes choosing hosting that “can defend against attacks, scan for emerging threats, and provide disaster-recovery resources” (Cloudflare).
• Shared hosting without server isolation increases the risk of cross-site contamination.

The catch: The security of a WordPress site depends more on plugin selection than on the core itself.

How to check if a WordPress site is hacked?

Scan with a security plugin (Wordfence, Sucuri SiteCheck)

• Sucuri SiteCheck is a free online scanner that checks for known malware, blacklisting, and outdated software (Sucuri SiteCheck).
• Wordfence includes a file integrity scanner that compares your files against the WordPress repository originals.

Review user accounts for unknown administrators

• Rogue admin users are a common sign of compromise. Check Users → All Users; revoke any unrecognized accounts with elevated privileges.
• Audit user roles monthly to ensure no unused Administrator accounts remain active.

Check file integrity against original WordPress core files

• Plugins like Wordfence can revalidate core files by comparing cryptographic hashes.
• A manual diff against a fresh WordPress install reveals injected code.

Look for unusual 404 errors or redirects in analytics

• Sudden spikes in 404 errors often point to backdoor scripts being probed or executed.
• Check Google Search Console for security issues and manual actions.

Monitor server error logs and outbound traffic

• Watch for PHP errors referencing eval() or base64_decode—hallmarks of injected malware.
• Unexpected outbound connections (e.g., to known malicious IPs) indicate data exfiltration.

What this means: Early detection through weekly scans can save thousands in recovery costs.

How to backup a WordPress site manually?

1. Export the database via phpMyAdmin or WP-CLI.
2. Download the wp-content folder and wp-config.php via FTP.
3. Store backups off-site (cloud storage, separate server).
4. Schedule regular automated backups with a plugin (UpdraftPlus, BackWPup).
5. Test a restore on a staging site before disaster.

Export the database via phpMyAdmin or WP-CLI

• phpMyAdmin: select your database, click Export, choose SQL format, and save the file.
• WP-CLI: run wp db export backup.sql to export from the command line.

Download the wp-content folder and wp-config.php via FTP

• Use an FTP client (FileZilla, Cyberduck) to copy the entire wp-content folder and wp-config.php to your local machine.
• wp-config.php contains security keys and database credentials—store it securely (Cloudflare).

Store backups off-site (cloud storage, separate server)

• Never keep backups on the same server as your live site—a server compromise would destroy both.
• Services like Google Drive, Dropbox, or a dedicated backup host protect against hardware failure.

Schedule regular automated backups with a plugin (UpdraftPlus, BackWPup)

• Automated backups remove human error. UpdraftPlus sends copies to remote storage daily.
• WordPress.org recommends maintaining “regular backups and a recovery plan so a site can be restored after compromise or catastrophe” (WordPress.org Developer Resources).

Test a restore on a staging site before disaster

• Unvalidated backups are worthless. Restore the backup to a staging environment quarterly and verify all posts, users, and plugins work.
• This habit ensures you can recover within hours, not days.

The pattern: Automation and testing are what separate a recoverable incident from a total loss.

Can you password protect a WordPress website?

Use a plugin like Password Protected or WP Private Site

• Password Protected adds a site-wide password overlay for under-construction or preview sites. It works with caching plugins when configured correctly.
• WP Private Site restricts all content to logged-in users only—useful for membership and intranet sites.

Add HTTP authentication via .htaccess

• Create a .htpasswd file and add AuthType Basic directives to your .htaccess file. This method is server-level and independent of WordPress.
• It does not interfere with caching or WordPress user roles.

Password-protect individual pages or posts with visibility settings

• In the WordPress editor, set the post visibility to “Password protected.” This works per-page without affecting the rest of the site.
• No plugin required—ideal for private content on an otherwise public site.

Restrict site access to logged-in users only

• Use a plugin to redirect all non-logged-in traffic to the login page. This is common for membership sites and company wikis.
• Combine with role-based access (Editor, Subscriber) for fine-grained control.

Set a global site password for previews or under-construction sites

• If you’re building a site before launch, a single password keeps out search engines and early visitors.
• Plugins like “Coming Soon Page & Maintenance Mode by SeedProd” include a password gate.

96% of vulnerabilities identified in 2024 were in plugins, and just 4% were in themes. This confirms that third-party extensions remain the dominant entry point for attackers.

Patchstack, State of WordPress Security 2025

Keeping WordPress core, plugins, and themes up to date is the single most important security measure you can take. Regular backups ensure you can recover after any compromise.

WordPress.org Developer Resources

For any site owner who relies on WordPress for their business, the choice is clear: either invest a few hours each month in updates, backups, and scans, or risk a median recovery cost of $12,000 and weeks of downtime. There’s no middle ground.

Frequently asked questions