WordPress is secure when it is looked after, and risky when it is neglected. Most compromised sites are not targeted individually. They are caught by automated scans looking for old software and weak passwords. These ten steps close the most common doors.
1. Keep everything updated
Update WordPress core, themes and plugins promptly. Many attacks use known weaknesses that updates have already fixed.
2. Use strong, unique passwords
Use long passwords from a password manager, and never reuse them. Do not use "admin" as a username.
3. Turn on two-factor login
Two-factor authentication makes a stolen password far less useful.
4. Install only trusted plugins and themes
Download from reputable sources and avoid pirated or nulled themes, which often hide malware. Delete anything you no longer use.
5. Take regular backups
Keep automatic backups stored away from your server, and test that you can restore them. A good backup turns a disaster into a short delay.
6. Use SSL
An SSL certificate encrypts traffic between your visitors and your site and shows the padlock in the browser.
7. Limit login attempts and use a firewall
A web application firewall and login limits block much of the automated attack traffic.
8. Give people the least access they need
Only give admin access to people who truly need it, and remove accounts when staff leave.
9. Choose secure hosting
Your host is the foundation of security. Good managed WordPress hosting includes server hardening, monitoring and backups.
10. Monitor and respond
Scan for malware and watch for unusual changes. If you are hacked, restore from a clean backup, change all passwords and fix the cause.
Not sure where to start? Our WordPress maintenance plans include updates, security scans and backups, and our support team can clean up a hacked website.
