WordPress Security Best Practices 

When it comes to building a website, WordPress is a popular choice. More than 43% of websites on the internet run on it. But, being popular also makes WordPress a big target for hackers.  

You need to protect your hard work, your visitors’ trust, and maybe even your livelihood. Common threats like malware and outdated plugins can put them at risk. The good news is that securing your WordPress site doesn’t have to be complicated. 

In this guide, we’ll walk you through everything you need to know about WordPress security. From understanding why sites get hacked to simple tips you can apply today and advanced strategies to take your protection to the next level.  

Why WordPress sites get hacked 

Hackers don’t just go after big-name sites. They often aim for smaller websites because they’re easier to break into. Here are the most common reasons: 

Poorly coded or niche plugins 

Not all plugins are created equal. Some are poorly coded or abandoned by their developers, leaving dangerous gaps in your site’s defenses. Hackers often scan the web for sites using vulnerable plugins they know how to exploit. 

Plugin conflicts 

Even secure plugins can cause problems if they are incompatible. Conflicts between plugins can break site functionality and even create security gaps. 

Weak login security 

Hackers—through intrusive software and credential stuffing—can break in through the WordPress login page by guessing your username and password. This can be a lot easier if you use common ones like “admin” or “password123.” This method, called a brute force attack, is one of the most common hacks. 

No website firewall or malware scanner 

Without a Web Application Firewall (WAF) or malware scanner, hackers can launch automated attacks that flood your site with malicious traffic. Firewalls block harmful visitors, while malware scanners catch potential threats early. 

Basic WordPress security practices 

Let’s look at some of the basic security practices that can help protect your site from common threats. 

Keep WordPress updated 

Hackers constantly search for outdated websites with known security flaws to exploit. This makes keeping your WordPress core, themes, and plugins up-to-date one of the most critical steps in protecting your site. 

Outdated software is one of the top reasons WordPress sites get hacked. Even a small vulnerability in your WordPress version can be enough for attackers to gain control. 

How to stay updated: 

• Enable automatic updates for plugins and themes whenever possible. 

• Use tools like Smart Plugin Manager, which automatically updates your plugins and notifies you of any issues. 

• Manually check your WordPress dashboard at least once a week if you prefer hands-on control. 

Use strong usernames and passwords 

Hackers can try thousands of password combinations in minutes. A strong password makes this process much harder, while a unique username adds another layer of protection. 

How to create strong login credentials: 

• Avoid “admin” or common usernames like your website name or email address. Use something unique but easy for you to remember. 

• Create a strong password with a mix of uppercase and lowercase letters, numbers, and special characters. Example: G$2pY&kTn!x9. 

• Use a password manager like 1Password or LastPass to generate and store complex passwords securely. 

Install an SSL certificate 

A security sockets layer (SSL) certificate is essential for encrypting data exchanged between your site and its visitors. Without it, sensitive information like passwords, credit card numbers, and personal details could be intercepted by hackers.  

You’ll know a site has SSL if its URL starts with “https://” instead of “http://,” and visitors will see a secure padlock icon in their browser’s address bar. 

An SSL also boosts your site’s credibility and search engine rankings. Search engines like Google rank secure sites higher, and visitors are more likely to trust a website that’s clearly protected. 

How to get an SSL: 

• Many web hosts offer free SSL certificates through services like Let’s Encrypt. 

• Check your hosting provider’s control panel for a one-click SSL installation option. 

• If your host doesn’t provide SSL, consider switching to one that does or purchasing a certificate from a reputable provider. 

Use a security plugin 

Manually monitoring your website for security threats is time-consuming and impractical. That’s where security plugins come in. They act like digital watchdogs, scanning your site for suspicious activity, blocking malicious traffic, and alerting you to potential issues. 

Getting a reputable WordPress security plugin can stop attacks before they happen, saving you from costly downtime and data breaches. 

Recommended plugins: 

• Wordfence Security. Great for blocking malicious traffic and providing real-time monitoring. 

• Sucuri Security. Offers firewall protection and malware cleanup services. 

• Jetpack Security. Provides backups, security scanning, and downtime monitoring in one package. 

Backup your site regularly 

Even with the best security measures, no website is 100% hack-proof. That’s why regular backups are essential. If something goes wrong, whether due to a hack, a server crash, or human error, you can restore your site quickly and minimize downtime. 

Backups are your safety net. Without them, you risk losing valuable content, customer data, and even your entire site. 

How to back up your site: 

• Install a reliable backup plugin like UpdraftPlus, BackupBuddy, or BlogVault. 

• Set up automatic backups on a schedule that fits your update frequency—daily, weekly, or monthly. 

• Store backups offsite using cloud services like Google Drive, Dropbox, or Amazon S3. 

 Limit login attempts 

By default, WordPress allows unlimited login attempts, making brute force attacks much easier for hackers. Limiting the number of failed login attempts can block attackers before they guess the right password. 

Preventing repeated login attempts makes it much harder for hackers to brute-force their way in, especially when paired with strong passwords. 

How to set it up: 

• Install a plugin like Limit Login Attempts Reloaded or Login LockDown. 

• Configure the plugin to lock out users after a certain number of failed login attempts. 

• Set the lockout period to at least 15-30 minutes to slow down automated attacks. 

Intermediate WordPress security practices 

Once you’ve nailed the basics, it’s time to step up your WordPress security game. These intermediate practices require a bit more effort but can significantly strengthen your website’s defenses. 

Change the default login URL 

Most WordPress login pages are located at yourdomain.com/wp-admin or yourdomain.com/wp-login.php, which hackers already know. Changing this login page URL can throw attackers off, making it harder for them to launch cyber-attacks on it. 

How to change it: 

• Install a plugin like WPS Hide Login or LoginPress. 

• Choose a custom login URL that only you know, like yourdomain.com/customlogin. 

• Make sure to bookmark your new login page to avoid being locked out. 

Enable two-factor authentication (2FA) 

Two-Factor Authentication (2FA) adds an extra layer of security by requiring users to verify their identity with a second device, like their smartphone. Even if a hacker somehow gets your password, they won’t be able to log in without the second factor. 

How to set it up: 

• Install a plugin like Google Authenticator – Two Factor Authentication or WP 2FA. 

• Set up 2FA for your admin account and any other user roles with access to sensitive areas of your site. 

• Use an authenticator app like Google Authenticator or Authy. 

Disable XML-RPC 

XML-RPC is a feature that allows remote access to WordPress through third-party apps. While it’s useful for tools like the WordPress mobile app or Jetpack, it’s also a common entry point for hackers, especially in DDoS attacks (Distributed Denial of Service) and brute force attempts. 

If you don’t need XML-RPC, disabling it removes a major target for hackers. 

How to disable it: 

• Use a plugin like Disable XML-RPC or All In One WP Security & Firewall. 

• Alternatively, add this code to your site’s .htaccess file. You can allow specific IPs if needed, or you can remove that line from the code: 

<Files xmlrpc.php>
order deny,allow
deny from all
allow from xxx.xxx.xxx.xxx
</Files>

Advanced WordPress site security tips 

If you’ve already tackled the basics and intermediate tips, it’s time to move on to advanced strategies. They require a bit of technical know-how, but the added protection is well worth the effort. 

Set up a web application firewall (WAF) 

A Web Application Firewall (WAF) is your website’s first line of defense against malicious traffic. It filters incoming requests and blocks anything that looks suspicious, such as DDoS attacks, SQL injections, and cross-site scripting (XSS). 

How to set it up: 

• Use a cloud-based WAF service like Cloudflare, Sucuri Firewall, or Astra Security. 

• Many premium WordPress security plugins, like Wordfence or iThemes Security, include built-in firewall protection.  

Secure the wp-config.php File 

Your wp-config.php file is one of the most critical files in your WordPress installation because it contains your site’s database credentials and security keys. One important security measure is to use the Disable File Editing WordPress feature in the admin dashboard.  

This prevents unauthorized users from altering theme or plugin files if they gain access to your site. 

How to secure it: 

• Move the wp-config.php file outside the root directory. WordPress will still be able to find it if you move it one level up. 

• Restrict file permissions by adding this code to your .htaccess file: 

Disable PHP File execution 

Hackers often upload malicious PHP files to WordPress directories like wp-content/uploads. Disabling PHP execution in these folders prevents such files from running, even if they are uploaded. 

How to disable it: 

• Create a file named .htaccess in your wp-content/uploads folder and add this code: 

Change database table prefix 

By default, WordPress uses the wp_ prefix for all its database tables. Hackers know this and target sites using the default prefix. Changing it makes your site less predictable and harder to hack. 

Switching to a custom database prefix adds an extra layer of security by making database table names less guessable. 

How to change it: 

• Use a plugin like iThemes Security or WP-DBManager to change your database prefix. 

• If you prefer manual changes, back up your database first, then update the prefix in phpMyAdmin and the wp-config.php file. 

Monitor and audit site activity 

Monitoring your website’s activity can alert you to suspicious behavior before it becomes a major problem. An activity log records changes like new user registrations, file uploads, and login attempts. 

How to set it up: 

• Use plugins like WP Security Audit Log, Simple History, or Activity Log. 

• Set up real-time notifications for critical actions like failed login attempts or file changes. 

Lock down your WordPress site like a pro 

By following a mix of basic, intermediate, and advanced WordPress security tips, you can protect your site from most online threats and keep your hard work safe. 

Start small: update your plugins, use strong passwords, and enable an SSL certificate. As you get more comfortable, add extra layers like login protection and database security. Finally, stay proactive with regular maintenance and activity monitoring since security is an ongoing process, not a one-time fix. 

Need Expert Help? Web.com offers robust website security services that keep your site safe while you focus on growing your business. Don’t wait until it’s too late—lock down your site today! 

Frequently asked questions