WordPress Security Guide: Logins, Plugins, Updates and Backups

Most hacked WordPress sites are not the result of a clever attack on WordPress itself. They are the result of a weak or reused password, an outdated plugin or a missing backup. That is good news: the fixes are known, and most of them take less than an hour. This WordPress security guide covers them in order of impact, from logins to backups.

1. Lock down logins

The login page is the most attacked part of any WordPress site. Bots try thousands of username and password pairs every day.

• Use two-factor authentication (2FA) for every account that can publish or change settings. An authenticator app is stronger than SMS.
• Use long, unique passwords stored in a password manager. Never reuse a password from another service.
• Limit login attempts and block repeated failures. Most security plugins do this.
• Do not use “admin” as a username, and do not publish the login name as the author name or author URL.
• Give each person their own account with the lowest role that works. Remove accounts when people leave.
• Add CAPTCHA (or a modern alternative) to login and form pages if bots are a problem.
• Review login activity. A security plugin can alert you to new admin users and logins from unusual locations.

2. Keep WordPress, themes and plugins updated

Known vulnerabilities in outdated plugins are the most common way in. Keep core, themes and plugins current, and remove anything you do not use (deactivated plugins can still be exploited if the files remain). Before updating a busy site, take a backup, and test large updates on a staging copy first.

3. Choose a security plugin, not five

One well-configured security plugin is better than several that overlap. Common choices:

• Wordfence: firewall, malware scan, login security with 2FA and alerts.
• Solid Security (formerly iThemes Security): hardening settings, 2FA and brute-force protection.
• Sucuri: a cloud firewall and malware clean-up service, useful when you want protection before traffic reaches the server.

Whatever you choose, turn on the firewall, schedule scans, enable email alerts for critical issues and check those alerts. A plugin that nobody reads gives a false sense of safety.

4. Hosting, SSL and the server

• Use managed WordPress hosting with server-level firewalls, automatic backups and current PHP versions.
• Serve the whole site over HTTPS with a valid SSL certificate, and redirect all HTTP traffic.
• Keep file permissions tight, disable file editing in the dashboard, and use SFTP, not FTP.
• Protect the database with a unique table prefix and strong credentials, and never expose database backups in a public folder.

Quick hardening settings

• Turn off XML-RPC if nothing uses it (some apps and Jetpack do, so check first).
• Hide the list of users from the public REST API and block author ID scans, which bots use to find login names.
• Remove the WordPress version number from the page source and delete readme files from the web root.
• Add security headers at the server or firewall: HSTS, X-Content-Type-Options and a sensible referrer policy.
• Remove themes you do not use, keeping one default theme as a fallback.

5. Backups you have actually tested

A backup only counts if you can restore it. Keep daily backups of files and database, store copies off the server, keep several days of history, and test a restore at least twice a year. After a hack, a clean backup from before the infection is often the fastest way back.

6. Monitor and respond

• Use uptime monitoring so you know within minutes when the site goes down.
• Watch Google Search Console for security issues and manual actions.
• Check for new admin users, unknown plugins, spam pages and redirects you did not create.

If the site is hacked: put it in maintenance mode, change all passwords and keys, restore from a clean backup or remove the malware, update everything, then find and close the way in. Request a review in Search Console if Google flagged the site.

7. Integrations and the REST API

Automations and apps that connect to WordPress need their own user, the lowest role that works and their own application password, so one leaked key never gives full admin access. See our WordPress REST API guide for details.

A short security checklist

• 2FA on every admin and editor account
• Updates applied weekly, unused plugins removed
• One security plugin with firewall and alerts
• HTTPS everywhere
• Daily off-site backups, restore tested
• Uptime and Search Console monitoring

Want someone to keep your site safe? Cyberset’s WordPress care plans cover updates, backups, security monitoring and fixes. See our WordPress web design services or request a website audit to find the gaps in your current setup.