WordPress itself is well maintained. Security holes mostly come from what gets added around it: plugins, themes, passwords and hosting. Here are the measures that count, from the most effective to the least.
How do you secure WordPress?
- Update the core, the theme and the plugins, after a backup.
- Delete unused plugins and themes, even deactivated ones.
- Only install from official sources: never a “nulled” version.
- Protect accounts: unique passwords, two-factor authentication, the smallest role that does the job.
- Add an application firewall and limit login attempts.
- Back up off the server, and test restoring.
Which security plugin should you choose?
One security plugin is enough, ideally with an application firewall and file scanning. Several security plugins together get in each other’s way and slow the site down. Some hosts already provide a server-level firewall, which is even better.
Should you hide wp-admin?
Changing the login address cuts down on bot noise, but good passwords and two-factor authentication still do the real work. Treat it as an extra.
Which settings should you add to wp-config.php?
// Disable file editing from the admin area
define( 'DISALLOW_FILE_EDIT', true );Also force HTTPS, check file permissions and regenerate the security keys if you suspect an intrusion.
Which security headers should you turn on?
At server level: Strict-Transport-Security to enforce HTTPS, X-Content-Type-Options: nosniff, Referrer-Policy and a content policy (Content-Security-Policy) suited to your site. Test them before rolling them out everywhere.
How do you back up properly?
Files and database, as often as you make changes, stored off the server, with several versions kept. A backup is only worth something if you’ve already tested restoring it.
Roles and access
Each person should have their own account with the minimum role they need. An editor doesn’t need to be an administrator. Delete accounts belonging to former contractors, and share hosting access through named accounts rather than a common password.
- One account per person, never a shared account.
- The Administrator role kept for one or two people.
- Two-factor authentication required for administrators.
- A unique password, generated by a password manager.
Plugins: the number one risk
Before installing a plugin, check when it was last updated, how many active installs it has and whether it’s compatible with your version of WordPress. A plugin abandoned for over a year is a risk, even if it still works.
What should you do regularly?
| How often | Action |
|---|---|
| Every week | Apply security updates, check the backups |
| Every month | Review user accounts and unused plugins |
| Every quarter | Test restoring a backup |
| Every year | Check the PHP version and your hosting plan |
What now?
What you can do today:
- Turn on two-factor authentication for your administrator account.
- Delete deactivated plugins and themes.
- Check that your backups are stored off the server.
Dig deeper: WordPress Repair and Hacked Site Cleanup
