WordPress Website Security: What You Need to Know

WordPress security is not a single thing you set up once and forget. It is a set of habits and configurations that, maintained consistently, keep a site genuinely well-protected. The good news is that none of it is complicated. The bad news is that most WordPress sites are not doing all of it, which is why compromised WordPress sites are so common.

This guide covers everything a business owner or site manager needs to understand and act on. Not an exhaustive technical manual, but the complete practical picture of what matters, why it matters, and what to do about it. If you already have an article on whether WordPress is secure in general, think of this as the companion piece: that article explains the landscape; this one tells you what actually to do.

Understand the Threat Landscape

Before getting into specific measures, it helps to know what you are actually defending against. WordPress sites face a relatively small set of common attack types, and most security measures map directly onto one of them.

Automated credential attacks

Bots scan the internet constantly looking for WordPress login pages and attempting to log in using lists of common usernames and passwords. This is called a brute force attack. Your login page at /wp-admin or /wp-login.php is publicly accessible by default, which means any bot on the internet can attempt to log in as many times as it likes unless you put something in the way.

Vulnerable plugins and themes

The most common route into a WordPress site is through a security vulnerability in an outdated plugin or theme. When a vulnerability is discovered and publicly disclosed, automated tools begin scanning for sites running the affected version within hours. A site that is not updated promptly after a security patch is released is exposed during exactly the window when the risk is highest.

Weak credentials

Simple passwords, reused passwords, and default usernames like ‘admin’ are all trivially exploitable. A strong password combined with two-factor authentication makes credential-based attacks practically impossible for automated tools.

Malicious file uploads

Some attacks target the ability to upload files to a WordPress site, typically through a vulnerable plugin or theme, and use that to place malicious code on the server. Proper file upload handling and server-level restrictions reduce this risk considerably.

Outdated WordPress core

Less common as an attack vector than plugins, because WordPress core receives security updates promptly and most hosts apply minor security updates automatically. But a site running a significantly outdated version of WordPress is taking an avoidable risk.

The Non-Negotiable Basics

These are the measures that every WordPress site should have in place without exception. None of them requires technical expertise. All of them are free or close to it.

Keep everything updated

WordPress core, every active theme, and every active plugin should be running the current version. This single habit prevents the majority of successful attacks on WordPress sites. Updates should be applied within days of release, not weeks or months.

WordPress applies minor security updates automatically by default. Major version updates and plugin updates require manual action from the admin dashboard or explicit configuration to automate. Checking for updates once a week takes five minutes and is the most valuable five minutes you will spend on your site’s security.

Use strong, unique passwords

Every account with access to the WordPress admin area should use a strong password that is not used on any other site. Twelve characters minimum, mixing letters, numbers and symbols. A password manager makes this practical. LastPass, 1Password and Bitwarden all have free tiers that are adequate for personal use.

Change the default admin username

If your WordPress installation was set up with a username of ‘admin’, change it. Automated attack tools try ‘admin’ first because it is the default. It is not a username; it is a welcome mat. Create a new administrator account with a different username, log in with the new account, and delete the old admin account.

Enable two-factor authentication

Two-factor authentication (2FA) requires a second verification step beyond the password when logging in, typically a time-limited code from an authenticator app on your phone. Even if an attacker has your password, they cannot log in without the second factor. Plugins like WP 2FA, Google Authenticator for WordPress, or Wordfence’s built-in 2FA all provide this for free.

Protecting the Login Page

Since the login page is the primary target for automated attacks, it deserves specific attention beyond just having a strong password and 2FA.

Limit login attempts

By default, WordPress allows unlimited login attempts. A brute force attack can try millions of password combinations given enough time. A login attempt limiter blocks an IP address after a specified number of failed attempts, making automated attacks impractical. Wordfence, Limit Login Attempts Reloaded and several other plugins provide this.

Consider changing the login URL

The default WordPress login page is at yoursite.com/wp-login.php. Changing this to a custom URL removes the site from automated scans that specifically target the default path. WPS Hide Login is a lightweight plugin that does exactly this. It is not a security measure in isolation, but it reduces the volume of automated attack attempts your site has to handle.

Use CAPTCHA on the login form

Adding a CAPTCHA to the login form blocks automated tools from submitting login attempts at scale. Google reCAPTCHA integrated via a plugin is the most common approach. Cloudflare Turnstile is a less intrusive alternative that is increasingly favoured.

Installing a Security Plugin

A security plugin provides a layer of protection and visibility that the WordPress core does not include by default. The main options each take a slightly different approach.

Wordfence Security

The most widely used WordPress security plugin. The free version includes a web application firewall, malware scanner, login security and real-time traffic monitoring. It is comprehensive and well-maintained. The premium version adds real-time firewall rule updates and IP blocklist access, which provide meaningful additional protection for business sites. Wordfence is a good default choice for most WordPress sites.

Solid Security (formerly iThemes Security)

A strong alternative to Wordfence with a similar feature set. The free version covers the essential bases. Worth considering if you prefer its interface or find it conflicts less with other plugins on your specific setup.

Sucuri Security

Sucuri’s free plugin provides security activity auditing, file integrity monitoring and blocklist monitoring. The paid Sucuri service adds a cloud-based web application firewall and CDN, which is a more comprehensive solution for higher-risk or higher-traffic sites. Sucuri is also well-known for its malware removal service, which is useful to know about if you ever need it.

Backups: Your Last Line of Defence

No security measure is perfect. If a site is compromised despite everything, a recent, clean backup is the difference between a few hours of recovery work and a potentially catastrophic loss of the site entirely.

Backups need to be automatic, regular, and stored somewhere other than the server the site runs on. A backup stored on the same server as the site is not a backup for a serious security incident. Store backups in cloud storage such as Google Drive, Dropbox, Amazon S3 or similar.

Recommended backup plugins

• UpdraftPlus is the most widely used backup plugin for WordPress and has a capable free tier that covers automated scheduled backups to cloud storage. The premium version adds backup to additional destinations and provides a migration tool.
• BackupBuddy is a premium-only option that is well-regarded for comprehensive backup and migration functionality.
• Jetpack Backup is a managed backup service from Automattic (the company behind WordPress.com) with real-time backup capability. More expensive than UpdraftPlus Premium but simpler to manage.

How often to back up

A site that changes frequently should be backed up daily. A site that is updated occasionally, adding a blog post or changing a page every week or two, can be backed up weekly. The question to ask is: how much work would you be willing to lose? If losing a week of content would be tolerable, weekly backups are sufficient. If even a day’s work is worth protecting, daily backups are appropriate.

Back up before any significant update or change, regardless of the scheduled backup frequency. Applying a major plugin update or WordPress version update is a sensible trigger for a manual backup.

Hosting and Server-Level Security

Some security measures happen at the server level rather than within WordPress itself, and they are worth understanding even if you are not managing the server directly.

• PHP version: WordPress recommends running the current or most recent stable PHP version. Older PHP versions stop receiving security updates. Your hosting control panel typically shows which PHP version your site is using and allows you to update it.
• File permissions: WordPress files and directories should have appropriate permissions set at the server level. Overly permissive file permissions allow uploaded files to execute code they should not be able to run. A reputable host configures this correctly by default; it is worth checking if you are on older or poorly managed hosting.
• Disable XML-RPC if not needed: XML-RPC is a WordPress feature that allows remote connections to the site. It is a common target for brute force attacks and can usually be disabled entirely unless you specifically need it for a mobile app or third-party service integration.
• Web Application Firewall: Some hosting providers include a server-level WAF as part of their offering. Managed WordPress hosts like Kinsta and WP Engine do. Cloudflare’s free tier also provides WAF functionality. A server-level WAF blocks malicious requests before they reach WordPress at all.

The Security Audit Checklist

☐  WordPress core is running the current version

☐  All themes are running current versions, including inactive themes

☐  All plugins are running current versions

☐  Inactive plugins are deactivated and deleted

☐  Inactive themes are deleted

☐  Default ‘admin’ username has been changed or deleted

☐  All admin accounts use strong, unique passwords

☐  Two-factor authentication is enabled for all admin accounts

☐  Login attempt limiting is configured

☐  A security plugin is installed and actively monitored

☐  Automated backups are running on a regular schedule to off-site storage

☐  Backups have been tested by performing a restoration to confirm they work

☐  The site runs over HTTPS with a valid SSL certificate

☐  PHP version is current

☐  XML-RPC is disabled if not needed

☐  Login URL has been changed from the default if not using a different protection method

Frequently Asked Questions

How often should I run a malware scan on my WordPress site?

A security plugin like Wordfence can be configured to run automated scans on a schedule, typically weekly. This is the most practical approach for most sites. Running a manual scan immediately after a significant update or whenever something unusual is noticed is also good practice. Sites with higher traffic or handling sensitive data benefit from more frequent scanning.

Do I need a paid security plugin or is the free version enough?

For most small business WordPress sites, the free version of Wordfence or an equivalent provides adequate protection when combined with the other measures in this article. The premium versions of security plugins add real-time firewall rule and threat intelligence updates, which provide earlier protection against newly discovered vulnerabilities. For sites handling financial transactions, personal data, or representing a high-profile brand, the additional protection of a premium security plugin is worth considering.

My site has been hacked. What do I do first?

Take the site offline immediately if possible to prevent it from serving malicious content to visitors. Change all passwords for all accounts associated with the site, the WordPress admin, the hosting control panel and the database. Restore from a clean backup if one is available from before the compromise. If no clean backup exists, use a professional malware removal service such as Sucuri or Wordfence Premium’s site cleaning service. Once clean, identify how the attack occurred and address the underlying vulnerability before putting the site back online.

Is SSL the same as website security?

No. SSL, the technology behind the padlock icon and HTTPS, encrypts data in transit between the visitor’s browser and the server. It prevents traffic interception and is a baseline requirement for any serious website. It does not protect against server-side vulnerabilities, malware, or unauthorised access to the WordPress admin area. SSL is one component of website security, not a substitute for the others.

Should I tell my web developer about security or is that their responsibility?

Both. A developer building or maintaining your WordPress site should be applying security best practices as a matter of course. But as the site owner, you are also responsible for understanding the basics and ensuring that ongoing maintenance is happening. The question of who applies updates, monitors for issues and manages backups should be explicitly agreed as part of any ongoing relationship with a developer or maintenance provider, rather than assumed.

Want Your WordPress Site’s Security Reviewed?

A security review covers everything in this guide plus hosting configuration, user access management and any site-specific vulnerabilities. Get in touch for a straightforward conversation about where your site stands.