Six concrete ways to protect WordPress: passwords and 2FA, updates, file permissions, backups, monitoring, and fewer administrators.
Topics Hardening & checklists Beginner guides
Updated Published
WordPress is a common target because it is common, not because it is uniquely weak. Most takeovers still come from guessed passwords, outdated plugins, or leftover administrator accounts. These six defenses remove a large share of that risk.
Deeper playbooks: security checklist, hardening guide, login security.
Use a password manager. Every admin (and every site) gets its own long random secret. Turn on two-factor authentication for administrators and anyone who can install plugins.
Memorable sentence passwords help some people. Random manager passwords help more. Avoid shared “company admin” logins in chat threads.
Related: password tips, common weak admin passwords.
Unpatched plugins are the usual entry point. Update on a schedule. Delete what you do not use, including deactivated leftovers. Scan installed software for known issues with a vulnerability scanner.
Typical defaults: directories 755, files 644, and a tighter wp-config.php when the host allows it. Never use 777 to silence an installer error.
Step-by-step: fix file and folder permission errors.
Security reduces probability. Backups reduce impact. Keep automated offsite copies of files and the database, and test a restore once. Guide: WordPress backup tips.
Unknown admin users, modified plugin files, and odd login spikes are early warnings. Use activity logging and malware scanning. Security Ninja’s Events Logger and malware scanner are built for that job.
If you are already compromised: hacked site steps.
Every administrator is a phishing target who can install malware. Give editors and authors the lowest role that works. Review Users monthly. Details: WordPress user roles.
You will not make a public site unhackable. You can make opportunistic attacks noisy, expensive, and recoverable.
Found this useful? Share it.
