WordPress website security: 10 things to check
- Most WordPress break-ins happen through outdated plugins, not the WordPress core.
- Two-factor authentication and least-privilege user roles prevent most account takeovers.
- A backup is only valuable if restoring it has been tested.
WordPress is a secure platform when it is maintained. Because it powers a large share of the world’s websites, it is also a popular target for automated attacks. The good news is that most break-ins are prevented with a few basics. Go through these ten points on your own site.
10 things to check
1. Update the core, theme and plugins
Plugin vulnerabilities are published openly, and attack bots often exploit them the same day. Update regularly and test updates before production.
2. Remove unused plugins and themes
Even a deactivated plugin that is still installed can be a vulnerability. Every removed plugin is one less thing to update.
3. and 4. Two-factor authentication and user roles
Enable two-factor authentication for all administrators. Give content creators the editor role, not administrator, and remove the accounts of former employees and partners.
5. Backups in a separate location
A backup on the same server does not help if the server is lost. Keep copies separately and test restoring them regularly.
6., 7. and 8. Server, login and HTTPS
Use a supported PHP version, limit login attempts and enable a firewall. The whole site should run over HTTPS.
9. and 10. File editing and monitoring
Prevent theme and plugin editing from the dashboard with the DISALLOW_FILE_EDIT setting. Monitor uptime and file changes so that anomalies are noticed immediately.
Never use nulled plugins
Illegal free copies of paid plugins often contain a backdoor. The saving is a few euros, the risk is the whole site and your customer data.
Security monitoring and controlled updates are part of our maintenance service. Read also what website maintenance includes.
FAQ
Is WordPress secure?
Yes, when it is maintained. Most break-ins are caused by outdated plugins, weak passwords or illegal plugin copies, not by the WordPress core.
What should I do if my WordPress site has been hacked?
Take the site offline if needed, change all passwords, restore a clean backup and find out how the break-in happened. Removing the malicious code alone is not enough.
Do I need a security plugin?
A plugin can help, but it does not replace updates, strong credentials and backups. Some protections are better done at server level.
