WordPress security: 12 practical steps and what to do if hacked

Most hacked WordPress sites aren't targeted by a person. Bots find them automatically while scanning for outdated plugins and weak passwords. Here are 12 practical measures that close those doors, plus what to do if your site has already been compromised.

12 measures that really matter

1. Update everything: core, plugins and themes

Most break-ins exploit plugin or theme vulnerabilities that are already known and fixed. The site owner just hasn't installed the update yet. Turn on automatic updates for WordPress minor releases and for plugins you trust (Dashboard → Updates, and the "Enable auto-updates" link in the plugin list). Check everything else at least once a week.

2. Long, unique passwords

Use a password manager and WordPress's own generator. Every account gets its own password: WordPress, the hosting panel, FTP/SFTP, the database and e-mail. Avoid your company name, your site name and dictionary words.

3. Two-factor authentication (2FA)

A code from an authenticator app stops almost every attack that relies on stolen passwords. Enable 2FA at least for administrators, using a reputable plugin. Turn it on for your client area and your hosting panel too, where available.

4. Fewer plugins and themes

Every plugin is extra code that may contain a vulnerability. Delete (don't just deactivate) plugins and themes you don't use. Keep a single fallback theme.

5. Trusted sources only

Install plugins and themes from the official wordpress.org directory or from well-known developers. Never use "nulled" (pirated) copies of premium themes, because they often ship with malicious code. Before installing, check when the plugin was last updated and read its reviews.

6. Least privilege for every user

WordPress has roles: Administrator, Editor, Author, Contributor, Subscriber. Someone who writes posts doesn't need to be an Administrator. Remove old accounts belonging to former staff, freelancers or the agency that built the site. Don't use "admin" as a username.

7. Backups you keep yourself

Backups are your insurance, and under our terms they are your responsibility. Save both the files and the database, keep copies off the server (on your computer or in cloud storage), and keep several versions. An infection can go unnoticed for weeks. Try a test restore now and then.

8. Correct file permissions

The official hardening guide recommends 755 for directories and 644 for files. wp-config.php should be as restricted as possible: the guide generally suggests 400 or 440, depending on the server. Never set 777, whatever a tutorial says.

9. Disable the built-in file editor

If someone gets into an administrator account, the theme and plugin editor lets them write PHP straight onto the server. Add this to wp-config.php:

define( 'DISALLOW_FILE_EDIT', true );

Then make code changes over SFTP or with your hosting file manager.

10. Limit login attempts

Bots try thousands of passwords against wp-login.php. A security or login-limiting plugin temporarily blocks an IP address after a few failed attempts. Combined with 2FA, brute-force attacks become practically useless.

11. Encrypted connections everywhere

Run the whole site on HTTPS so passwords never travel in plain text. For file transfers, use SFTP or FTPS instead of plain FTP. Don't log in to your admin area over public Wi-Fi unless you trust the connection.

12. Monitor

• An activity log plugin shows who logged in and what they changed.
• File scanning flags new or modified files in wp-admin, wp-includes and your themes.
• Google Search Console alerts you if Google detects security issues on your site.
• An uptime monitoring service e-mails you when the site stops responding.

What to do if your site has been hacked

Typical signs: redirects to dodgy sites, Google warnings, administrator accounts you didn't create, spam being sent from the server. These steps follow the advice in the WordPress guide for hacked sites:

1. Stay calm and write things down: what you see, since when, and what you changed recently (a new plugin, a theme).
2. Take a copy of the current state, infected or not, before cleaning anything.
3. Scan your own computer with antivirus software. Sometimes the passwords were stolen from there.
4. Change every password: WordPress (for all users), the hosting panel, FTP/SFTP and the database. Regenerate the security keys in wp-config.php to log everyone out.
5. Clean or restore. If you have a clean backup from before the infection, restore it. Otherwise, replace wp-admin and wp-includes with fresh files of the same version, reinstall plugins and themes from official sources, and check .htaccess and the files in wp-content/uploads (there should be no PHP files there).
6. Update everything and change the passwords again once the site is clean.
7. Request a review in Google Search Console if your site was flagged.
8. Write to us at [email protected] if you need access logs or if the server is sending spam. On shared hosting, we need to know.

WordPress security checklist

• Core, plugins and themes up to date, with auto-updates where possible.
• Unique passwords and 2FA for administrators.
• Unused plugins and themes deleted; only trusted sources.
• Users with minimal roles and no stale accounts.
• Backups of files and database, kept off the server and tested.
• Permissions 755/644, wp-config.php locked down, DISALLOW_FILE_EDIT on.
• Login attempts limited, HTTPS and SFTP in use.
• Activity log, scanning and monitoring in place.

Looking for hosting built around WordPress? See our WordPress hosting plans. For questions about what each plan includes, check the FAQ or write to us.