Article draft
WordPress security is a process rather than a one-time setting. A safer site combines controlled access, supported software, trusted extensions, secure hosting, monitoring and tested recovery. No checklist can eliminate every risk, but reducing common weaknesses can make a compromise less likely and recovery more manageable.
Secure accounts and administrator access
Use unique passwords, multi-factor authentication where available, and individual accounts for each person. Avoid sharing the main administrator login with staff or agencies.
Grant only the permissions needed for each role. Remove access when contractors or employees no longer work on the site, and keep domain registrar and hosting accounts protected as well as WordPress itself.
Grant only the permissions needed for each role. Remove access when contractors or employees no longer work on the site, and keep domain registrar and hosting accounts protected as well as WordPress itself.
Keep software supported
Update WordPress core, themes and plugins using a process that includes backup, compatibility review and testing. Remove unused themes and plugins, especially extensions from untrusted sources or those no longer maintained.
Do not download premium plugins or themes from unofficial sources. Modified packages can contain malicious code or leave you without security updates.
Protect data and configuration
Use HTTPS, maintain appropriate file permissions and avoid exposing configuration files or backups publicly. Keep secrets and credentials out of public repositories and web-accessible folders.
Use hosting-level protections and access controls where available. A security plugin can add useful features, but it cannot replace updates, sound account practices or a recovery plan.
Use hosting-level protections and access controls where available. A security plugin can add useful features, but it cannot replace updates, sound account practices or a recovery plan.
Backups, monitoring and incident readiness
Maintain backups that cover the website files and database, and keep an independent copy where feasible. Confirm retention, restoration steps and who can access backup storage.
Monitor administrator changes, unexpected redirects, new files, security alerts and unusual outbound email. Record how to contact your hosting provider and who is authorised to make emergency decisions.
If you suspect a compromise
Avoid deleting files at random or assuming a security scan alone proves the site is clean. Preserve useful logs, restrict affected access, contact the host or a qualified incident-response professional and investigate the entry point.
After cleaning, update vulnerable software, rotate affected credentials, review administrator accounts and restore from a known-clean backup if appropriate. Check the website and email for ongoing abuse.
Frequently asked questions
Is a WordPress security plugin enough?
No. A plugin can help with selected protections and alerts, but account security, updates, hosting configuration, backups and incident response remain important.
Should I change the WordPress login URL?
It may reduce some automated noise, but it is not a substitute for strong authentication, updates, access controls and monitoring.
Can a secure website still be hacked?
Yes. No setup is completely risk-free. Layered protection and a tested recovery plan help reduce risk and limit impact.
