How to secure a WordPress site

WordPress security hardening comes down to a short list of habits. To secure a WordPress site, keep WordPress, plugins and themes updated, remove anything you do not use, protect admin accounts with strong passwords and two-step login, turn off file editing in the dashboard, set sensible file permissions, protect the login page, and keep tested backups with monitoring. Outdated software and weak passwords are among the most familiar ways into a business website, so these basics close the doors attackers try first.

WordPress is the software behind many business websites and, through WooCommerce, many online stores. Hardening means reducing the ways an attacker could get in. This guide lists the steps in order of impact, so you can start with the ones that matter most. If you would like a security review, our cybersecurity service page explains how we work.

WordPress security hardening starts with updates and removing unused plugins

The official WordPress hardening guide is clear that you should keep up to date with the latest version, because older versions are not maintained with security updates. Plugins and themes are just as important, because each one adds code that attackers can target.

1. Update WordPress core. Apply updates promptly, starting on a staging copy if your site is complex.
2. Update plugins and themes. Since WordPress 5.5, administrators can turn on automatic updates plugin by plugin from the Plugins screen, and theme by theme from the Appearance screen.
3. Remove what you do not use. Deactivated plugins and unused themes still sit on the server. Delete them completely.
4. Choose plugins carefully. Prefer plugins that are actively maintained, recently updated and widely used. Avoid pirated "free" copies of paid plugins, which can contain hidden malicious code.
5. Check that updates actually run. Automatic updates rely on WordPress's scheduled tasks. The WordPress documentation on automatic updates suggests checking Tools > Site Health for errors if updates are not working.
6. Keep PHP supported. WordPress runs on PHP, which has its own supported versions. Ask your host to keep it current.

If automatic updates feel risky for an important plugin, such as your store or booking plugin, update it manually on a regular schedule after testing on staging. What matters is that updates happen.

Our guide on how business websites get hacked explains why outdated plugins are a common way in.

Admin accounts and two-factor login

Admin accounts can change everything on your site. Protecting them is one of the most effective steps you can take.

1. Give each person their own account. Never share one admin login. Individual accounts show who did what and can be removed when someone leaves.
2. Use the lowest role that works. WordPress roles such as Editor or Author allow content work without full control. Keep Administrator accounts to the people who truly need them.
3. Use strong, unique passwords. The official hardening guide describes a strong password as an important part of security. A password manager makes long, unique passwords practical.
4. Turn on two-step login. The same guide recommends enabling two-step authentication as an additional measure. With it, a stolen password alone is not enough to log in. It is usually added with a well-maintained plugin.
5. Review accounts regularly. Remove old staff, agencies and test accounts. Check for any admin account you do not recognise.
6. Avoid obvious usernames. Usernames such as "admin" are the first ones attackers try.

File permissions and editing

By default, administrators can edit theme and plugin code from inside the WordPress dashboard. If an attacker gains admin access, this editor lets them change code directly. Turning it off removes that option.

Add this line to the wp-config.php file:

define( 'DISALLOW_FILE_EDIT', true );

According to the official hardening guide, this is equivalent to removing the capabilities to edit themes, plugins and files from all users. Code changes should go through your developer's normal process instead.

File permissions control who can read and change files on the server.

1. Follow the official guidance. The hardening guide says files should be owned by your user account and writable by you, and that only files WordPress needs to write to should be writable by the web server.
2. Protect wp-config.php. This file holds your database password and security keys. Make sure it is not writable or readable by anyone who does not need it.
3. Avoid overly open permissions. Settings that let everyone write to files are a common shortcut when something does not work, and a common way in for attackers.
4. Ask your host. Hosting setups differ, so ask your host or developer to confirm permissions match the official recommendations for your server.

Hosting and server security

A secure WordPress installation still depends on the server underneath it. Many security features are best handled by the host.

1. Choose a host that keeps the server updated, including the operating system, web server and PHP.
2. Keep sites separate. If several websites share one hosting account, a problem in one can spread to the others. Separate accounts or containers reduce that risk.
3. Use secure access. Use encrypted connections such as SFTP or SSH for file access, not plain FTP, and remove access for people who no longer need it.
4. Protect the database. Use a unique database user and a strong password for each site.
5. Ask what the host monitors. Some hosts scan for malware, block known attacks and alert you to suspicious activity. Know what is included and what is your responsibility.

Protecting the login page

The WordPress login page is a well-known address, so it receives constant automated login attempts. Two-step login does most of the work, but a few extra steps help.

1. Limit login attempts. Block or slow down repeated failed logins from the same source. Many hosts and security plugins offer this.
2. Use a web application firewall. A firewall filters malicious traffic before it reaches WordPress. Many hosts and security services provide one.
3. Restrict access where practical. If only a few people log in from known locations, your host may be able to limit access to the admin area.
4. Use HTTPS everywhere. Make sure the whole site, including the login page, loads over HTTPS so passwords are encrypted in transit.
5. Watch for unusual activity. Alerts for new admin accounts or logins from unexpected places can reveal a problem early.

What security plugins can and cannot do

Security plugins can add useful features in one place, such as login limits, two-step login, file change alerts and malware scanning. They are helpful, but they are not a complete solution.

• They cannot replace updates. A plugin cannot fully protect outdated software with known weaknesses.
• They run inside WordPress. If an attacker gets past WordPress itself, a plugin may not see it. Server-level protection and off-site backups cover what plugins cannot.
• They need care too. A security plugin is still a plugin. Keep it updated and avoid installing several that do the same job, as they can conflict and slow the site.

Choose one well-maintained security plugin if you need its features, and review its settings rather than relying on the defaults.

Backups and monitoring

No security plan is complete without a way to recover. The official hardening guide advises backing up your data regularly, including your databases, and keeping regular snapshots of the whole installation in trusted places.

1. Back up files and the database. Both are needed to restore a WordPress site.
2. Store backups away from the server. A backup on the same server can be lost or damaged along with the site.
3. Keep several versions. If a problem goes unnoticed for a while, you need a backup from before it started.
4. Test restores. Restore a backup to a staging site regularly to prove it works.
5. Monitor the site. Uptime monitoring tells you when the site goes down. Security scanning and file change alerts can show when something has been modified.
6. Have a plan for incidents. Know who to call, where the backups are and how to take the site offline safely if it is compromised.

If the site is hacked

If you suspect a problem, act calmly and in order:

1. Put the site into maintenance mode or take it offline to protect visitors.
2. Change all passwords, including WordPress admin accounts, hosting, database and file access.
3. Find out what changed. Look for new admin accounts, unfamiliar files and modified plugins or themes.
4. Clean or restore. Remove the malicious changes, or restore a clean backup from before the problem started, then apply all updates.
5. Close the way in. Identify how the attacker got in, such as an outdated plugin or a stolen password, and fix it. Otherwise the problem is likely to return.

Security and speed often improve together, because removing unused plugins and keeping software current helps both. For stores, our guide on how to speed up a slow WooCommerce store covers the performance side.

Summary

• Keep WordPress, plugins, themes and PHP updated, and delete anything you do not use.
• Give everyone their own account with the lowest role that works, strong passwords and two-step login.
• Disable dashboard file editing and follow the official guidance on file permissions.
• Protect the login page with attempt limits, a firewall and HTTPS.
• Keep off-site, tested backups and monitor the site so you can recover quickly.

A well-maintained WordPress site is far harder to break into than a neglected one. If you'd like your WordPress site reviewed and hardened, you can tell us about it here.