How to secure a WordPress website: 9 practical steps

Most WordPress break-ins are not clever. Automated bots scan for sites running old code, weak logins, or add-ons pulled from the wrong place, then walk in through a door someone left open. Close those doors and the large majority of attacks fail before they start. The steps below come from WordPress’s own hardening guide and are ordered from the ones that stop the most attacks to the ones that limit the damage when something slips through.

Keep WordPress, themes, and plugins updated#

An outdated site is the single easiest target. WordPress has shipped automatic background updates since version 3.7, so let them run, and check the dashboard for theme and plugin updates that still need a manual push. Download core, themes, and plugins only from the official WordPress.org repository or a vendor you know — a copy from anywhere else can arrive with malware baked in. Anything you are not using is still attack surface, so deactivate and delete the plugins and themes you have stopped needing.

Harden the login page#

The login form is where brute-force bots spend their time. Start by not using admin as the username; WordPress notes that easily guessed names such as admin or webmaster are attacked first, so pick something less obvious. Give every account a long, unique password — a strong password or passphrase that is not reused on any other site. Then add two-factor authentication: WordPress core does not include 2FA, so you turn it on with a reputable plugin, ideally for every administrator. Finally, limit login attempts so a bot cannot guess forever. Many hosts and content delivery networks rate-limit wp-login.php at the edge; if yours does not, a security plugin can throttle repeated failures.

Encrypt traffic and run a security plugin#

Serve the whole site over HTTPS so passwords and session cookies are encrypted in transit instead of sent in the clear — WordPress specifically recommends an SSL-encrypted connection for the admin area. Most hosts now issue a free certificate, and once it is active you can require HTTPS site-wide. A dedicated security plugin then adds layers core does not: a web application firewall that blocks known malicious requests, malware scanning that flags changed files, and extra login protection. Well-known options such as Wordfence and Sucuri sit in this category — weigh them on features and independent reviews rather than treating any single name as an endorsement.

Limit access and back up on a schedule#

Give each person the least access they need to do their job. WordPress ships six built-in user roles, from Administrator down to Subscriber; a writer needs Author or Editor, not full admin rights, and fewer administrators means fewer accounts that can take over the site if one is compromised. No matter how careful you are, also keep current backups. WordPress’s backup guidance is to save both your files and the database — weekly for a quiet site, daily for a busy one, and always before an update — and to store copies in more than one place so a single failure never erases every version.

Priorities at a glance#

Measure	Why it matters
Update core, themes, and plugins	Closes known holes bots scan for; old code is the top entry point
Non-admin username and strong password	Removes the two values attackers try first
Two-factor authentication	A stolen password alone no longer grants access
Limit login attempts	Stops brute-force guessing before it succeeds
HTTPS everywhere	Encrypts logins and cookies so they can’t be read in transit
Security plugin (firewall and scanner)	Blocks malicious requests and flags changed files
Least-privilege roles	Limits the damage any one account can do
Regular backups	Lets you restore quickly after a hack or a mistake
Trusted sources only	Avoids malware hidden in nulled themes and plugins

None of these steps takes long on its own, and together they turn a soft target into a hard one. Set updates to run, lock down the login, and confirm a fresh backup exists — that trio alone stops most of what actually reaches WordPress sites.