In short: A WordPress site is protected above all by regular updates, a few reliable plugins, logins with two-factor authentication, limited permissions, tested backups kept off the server and monitoring that alerts you when something changes. The official WordPress guide to hardening lists the same areas.
WordPress powers a large share of the world's websites, which is why it is one of the most frequent targets of automated attacks. The core is carefully maintained. The problems almost always come from outside it: an outdated plugin, an abandoned theme, a weak password. The measures below should be applied roughly in this order.
1. Update everything, methodically
WordPress, themes and plugins receive security fixes. Attacks exploit flaws that are already known and already fixed. Update regularly and test updates on a copy of the site first, especially on a shop. See maintaining a WordPress site.
2. Cut down on plugins
Every plugin is third-party code running on your site. Deactivate and delete whatever you don't use. Before installing one, check when it was last updated and how widely it is used. Avoid plugins and themes downloaded from unofficial sources: they are among the most common channels for introducing malicious code.
3. Protect logins
- Long, unique passwords kept in a password manager.
- Two-factor authentication for administrators. See passwords and two-factor authentication.
- A limit on failed login attempts.
- No user called ‘admin’.
4. Grant few privileges
A contributor who writes posts doesn't need to be an administrator. Assign the minimum role required and check the list of users from time to time. Supplier accounts should be closed when the job is done.
5. Keep separate, tested backups
A copy off the server, taken often and with a verified restore. It is the difference between an incident and a week of downtime. The method is in backups that actually work.
6. Use HTTPS and security headers
The HTTPS certificate encrypts the connection. Some HTTP headers (for example those that restrict where scripts can be loaded from) reduce the damage from certain attacks. They are set on the server or with a plugin and checked with public tools.
7. Put a filter in front of the site
A protection service (a web application firewall) blocks malicious requests and automated traffic before they reach WordPress. It can be provided by your hosting company or by external services. It does not replace updates.
8. Close what you don't use
- Disable file editing from the admin area (the
DISALLOW_FILE_EDITconstant). - If you don't use the XML-RPC interface, restrict or disable access to it.
- Hide or protect backup and working folders inside the site.
- Check file and folder permissions on the server.
9. Watch what changes
Monitoring that flags file changes, new administrator users and unusual spikes lets you notice within hours rather than weeks. You also need an alert if the site stops responding.
10. Have a plan for when it happens
- Who decides and who acts.
- Where the backups are and how they are restored.
- How the site is put into maintenance mode and how customers are informed.
- How the entry points are found and closed. Cleaning up the files without understanding how the attackers got in leads to a new infection.
- How to ask Google to remove the warnings.
For shops: extra care
- Don't store card data on the site: rely on a payment provider.
- Check your shipping, payment and invoicing plugins: they handle customer data.
- Test the checkout after every major update.
Further reading: hacked website: what to do · compromised website recovery · website care and maintenance
Frequently asked questions
Why do WordPress sites get hacked?
The most frequent causes are outdated plugins or themes with known flaws, weak or reused passwords, components abandoned by their developers and overly broad permissions. The WordPress core is updated constantly: the risk lies mainly in the extensions.
How many plugins can you install?
There is no right number. Quality is what counts: each one increases the attack surface and the maintenance work. Keep only the ones you use and that their authors update regularly.
Is a security plugin enough?
No. It helps but it does not replace updates, backups and access management. A security plugin is an extra layer, not the first one.
How can you tell the site has been compromised?
Typical signs are pages or links you didn't create, redirects to other sites, Google warnings in search results, unknown administrator users, sudden slowdowns and emails sent from your domain that you didn't write.