Most hacked WordPress sites were not targeted by a clever attacker. They were caught by automated tools that scan the internet for known weaknesses: an old plugin, a weak password, an abandoned theme. The tools do not care whether your site is big or small. If a door is open, they walk in.
That is good news, because the same simple steps stop most attacks. This checklist lists fifteen steps in order of impact. You can work through the first eight in an afternoon.
Before you start
Take a full backup of your site and database and store it away from your server. Some of the steps below change settings, and a backup lets you undo anything that goes wrong. If you do not have a backup process yet, step one is to set one up, and our post on WordPress speed also covers why a clean setup helps.
Step 1: Keep everything updated
Outdated software is the leading way sites get compromised. Update WordPress core, your theme and every plugin. Turn on automatic updates for minor security releases. For larger updates, test on a staging copy first when your site is important to your business.
Step 2: Delete what you do not use
Inactive plugins and themes still sit on your server, and attackers can target them. Delete anything you do not use. Keep one default theme as a fallback, and remove the rest.
Step 3: Use strong, unique passwords
Every account needs a long, unique password, ideally created and stored in a password manager. Reused passwords are dangerous, because a leak at another service can be used against your site. This includes the database, the hosting account and the email address tied to the site.
Step 4: Turn on two-factor authentication
Add a second step to admin logins, such as a code from an app on your phone. Even if a password leaks, the attacker cannot sign in without the second factor. Do this for every administrator and editor account.
Step 5: Limit who has access
Review your user list. Remove accounts of people who left. Give each person the lowest role that lets them do their job. Few people need to be administrators. Use named accounts for every person, not a shared login.
Step 6: Change the default admin username
If any account still uses “admin”, create a new administrator with a different name and delete the old one. Attackers try the obvious names first.
Step 7: Choose reputable plugins and themes
Install software only from trusted sources, and prefer plugins that are updated often, widely used and supported. Avoid pirated “nulled” themes and plugins, which often contain hidden malware. Check the last update date and reviews before you install anything.
Step 8: Set up reliable backups
Backups do not stop attacks, but they make recovery possible. Run them automatically, store copies away from your server and test restoring from one. A backup you have never tested may fail when you need it. For a plan sized to your site, see our guide on WordPress backups.
Step 9: Use a security plugin or service carefully
A good security tool can scan for known malware, block repeated login attempts and warn you about outdated software. Choose one tool and set it up properly instead of stacking several, which can conflict and slow the site.
Step 10: Limit login attempts
Automated tools try thousands of password guesses. Limit failed attempts and temporarily block addresses that keep failing. Many security tools and some hosts include this.
Step 11: Protect the login page and admin area
You can restrict the admin area to known addresses where that fits your team, or add a challenge to the login form. Do not hide the login by methods that confuse your own team. Aim for simple protections that you will keep working.
Step 12: Use HTTPS everywhere
A security certificate encrypts the connection between visitors and your site. Make sure every page loads securely and that old addresses redirect to the secure version. Most hosts provide certificates at no extra charge.
Step 13: Choose secure hosting
Good hosts separate accounts, patch servers, scan for malware and offer firewalls. Cheap shared hosting with poor isolation can allow one compromised site to affect others. Ask your host what protections are included.
Step 14: Lock down file permissions and editing
Turn off the built-in theme and plugin file editor in the dashboard, so an attacker who gets in cannot change code easily. Make sure file permissions follow your host’s recommendations, so files are not writable by anyone.
Step 15: Monitor and plan for the worst
Set up uptime monitoring and alerts for important changes, such as a new administrator being created. Write a short plan for what you will do if the site is hacked: who to call, where backups are and how to restore. Our guide to cleaning a hacked WordPress site walks through the first hour.
How to prioritize
If you only have an hour, do steps one to five. They close the most common doors: outdated software, unused code, weak passwords and wide access. If you have an afternoon, add six to eight. Then schedule the rest across the month.
Signs your site may already be compromised
- Strange redirects, especially to unfamiliar sites.
- Pages or links you did not create.
- Your site flagged as unsafe by a browser or search engine.
- Unexpected administrator accounts.
- Sudden slowness or hosting warnings about unusual activity.
- Emails from your site blocked as spam.
If you see any of these, act quickly. Our malware cleaning service handles cleanup, and the steps above help prevent a repeat.
Make it a habit
Security is not a one-time project. New vulnerabilities appear all the time. A monthly routine of updating, checking users and testing backups keeps your protection current. If you would rather hand this task over, our WordPress care plan includes it.
Frequently asked questions
Do small sites get attacked?
Yes. Automated tools target weaknesses, not size. A small site with outdated plugins is an easy target.
Is WordPress insecure?
The core software is well maintained. Most problems come from outdated plugins, weak passwords and poor hosting.
Do I need a paid security plugin?
Not always. Free versions cover basics. Paid ones add features such as managed firewalls and cleanup support. Choose based on how important the site is.
How often should I back up?
As often as the site changes. A store that takes orders daily needs more frequent backups than a brochure site.
Next step
Start with updates, unused plugins, strong passwords, two-factor sign-in and access review. If you want an expert to check your site and fix what is weak, ask us for a security review.