How to secure WordPress in twelve steps
WordPress is the most popular target for automated attacks. These twelve steps close the most common gaps, no programming skills required.
WordPress powers a large share of all websites worldwide. That is exactly why it is the favourite target of automated attacks: programs scan the internet around the clock for WordPress sites with outdated plugins or weak passwords. Most successful attacks don’t use sophisticated tricks, but long-known vulnerabilities.
These twelve steps close the most common doors. You don’t need any programming skills.
Update and tidy up
1. Automatic updates for WordPress itself. WordPress installs minor security updates automatically unless this has been switched off. Check under “Dashboard → Updates” that it is active.
2. Keep plugins and themes up to date. Most vulnerabilities are in plugins, not in WordPress itself. Turn on automatic updates for every plugin or check at least weekly.
3. Delete unused plugins and themes. Even deactivated plugins sit on the server and can be attacked. Delete everything you don’t need. Keep only one default theme as a fallback.
4. Only plugins from trustworthy sources. Use plugins from the official directory or from well-known developers. Stay away from “free” versions of paid plugins from dubious sources. They often contain malicious code.
5. Replace abandoned plugins. If a plugin hasn’t been updated for over a year, it has probably been abandoned. Vulnerabilities will no longer be fixed. Look for a maintained alternative.
Protect access
6. No user called “admin”. Attackers try this name first. Create a new administrator with a different name and delete the old one. You can assign the posts to the new user in the process.
7. Strong, unique passwords. For all users with editor or administrator rights. Create them with the password generator and check existing ones with the password checker.
8. Two-factor login. A security plugin or a dedicated 2FA plugin adds extra protection to the login. More in Two-factor authentication.
9. Limit login attempts. A plugin that temporarily blocks the IP address after a few failed attempts stops automated password guessing. Many hosts also offer this on the server side.
10. Hand out roles sparingly. Not everyone needs administrator rights. Anyone who only writes posts gets the “Author” or “Editor” role. Delete accounts of former employees and agencies.
Server and configuration
11. Disable file editing in the dashboard. WordPress lets you edit theme and plugin files directly in the browser. If an attacker gets into the dashboard, they can insert malicious code this way. One line in the wp-config.php file switches it off:
define('DISALLOW_FILE_EDIT', true);
12. Set security headers. A few lines in .htaccess protect visitors against clickjacking and injected code. Use the security headers check to see which ones are missing and follow the instructions in Security headers explained.
For emergencies
Backups. An automatic daily backup of files and database, with at least one copy outside the server. Test once that you can restore it. More in The 3-2-1 backup rule.
Monitoring. When a site is hacked, its content often changes or it goes down. A monitoring service reports this immediately; see Website monitoring.
What a security plugin does
Well-known security plugins bundle many of these points: firewall, login protection, 2FA, checks for modified files and notifications. They don’t replace updates, though. A security plugin on a site with outdated plugins is like an alarm system with the front door left open.
Signs that your site has been hacked
- New administrators you don’t recognise
- Pages or posts advertising medication, gambling or loans, often only visible to Google
- Redirects to strange sites, sometimes only on phones or when visitors come from Google
- Warnings from Google or your host
Then: change all passwords, inform your host and restore the site from a clean backup. Deleting individual suspicious files is rarely enough, because attackers usually leave several back doors.