WordPress powers a huge share of the web, which is exactly why it gets so much attention from attackers. That does not mean WordPress is unsafe. It means neglected sites are easy targets. Most hacked sites I have seen were not compromised because WordPress is inherently broken. They were compromised because something basic was ignored for too long.
The good news is that beginners do not need a complicated security stack. A simple checklist covers the majority of the risk. If you handle hosting, updates, passwords, login protection, backups, and a few hardening steps, you remove most of the easy attack paths before they become a problem.
I learned that the hard way. Once you have dealt with a hacked site, you stop treating security like an optional extra. The upside is that the essentials are not difficult. You can make a WordPress site much safer without becoming a security expert.
1. Choose a secure host from the start
Server-level security matters more than any plugin you install later. If your host is weak, you are starting behind. If your host has strong firewalls, malware scanning, automatic backups, and decent isolation between accounts, you begin with a much safer foundation.
This is why I like Kinsta for beginners who want less guesswork. It includes enterprise-grade firewalls, DDoS protection, malware scanning, and automatic backups, which removes a lot of the burden from the site owner.
If you are comparing hosts, ask one question first: what security do I get before I install a single plugin? The answer tells you a lot. A good host will stop many problems at the server layer, which is exactly where you want them stopped.
2. Keep WordPress core, themes, and plugins updated
Outdated software is still the most common attack vector. Hackers look for known vulnerabilities in old plugins and themes because they are easy to automate. If you stay updated, you close the doors they are checking first.
WordPress makes auto-updates possible for core, plugins, and themes. I recommend being selective instead of turning everything on blindly. Core updates are usually safe to automate. Trusted plugins and themes can also be auto-updated if they are well maintained and you have backups in place. For anything critical or custom, test updates first if you can.
- Turn on automatic updates for WordPress core.
- Enable auto-updates for trusted plugins with a strong maintenance record.
- Remove plugins and themes you no longer use.
- Check the site after major updates, not six weeks later.
The key is consistency. A site that is updated regularly is far less attractive to attackers than one that sits untouched for months.
3. Use strong passwords and a password manager
This sounds obvious, but weak passwords are still one of the easiest ways into a site. Your admin account, FTP access, database logins, hosting dashboard, and email account all matter. If one of those gets reused with a weak password, the whole setup becomes easier to compromise.
I use a password manager like 1Password or Bitwarden so I do not have to memorize anything clever. The point is not convenience alone. The point is unique, random passwords everywhere, with no reuse across services.
- Use a long, random password for WordPress admin.
- Change default FTP or SFTP credentials if they are weak.
- Protect your email account with the same level of care.
- Never store passwords in notes, spreadsheets, or chat threads.
If one login protects access to your site, treat it like a lock on your front door, not a sticky note on a monitor.
4. Change your admin username
Never use admin as your WordPress username. Attackers try it constantly because it still works on too many sites. If your username is predictable, brute force attacks become easier.
If your site already uses admin, create a new administrator account with a unique username, log out, then log back in with the new account and delete the old one. WordPress will usually ask what to do with the old content. Reassign it to the new account.
That one small change removes a very common guess from the attacker’s playbook. It is a simple win.
5. Enable two-factor authentication
Two-factor authentication, or 2FA, adds a second check at login. Even if someone steals your password, they still need the code from your phone or authenticator app. That makes a huge difference for admin accounts.
For WordPress, you can use a plugin like WP 2FA or pair a login plugin with an authenticator app such as Google Authenticator. The exact tool matters less than the habit. Add 2FA to every account that can change your site.
- Enable 2FA for all administrator accounts.
- Keep recovery codes somewhere safe.
- Use an authenticator app instead of SMS when possible.
Once 2FA is on, login security gets much stronger with almost no daily effort.
6. Limit login attempts
Brute force attacks work by trying passwords over and over until one sticks. Limiting login attempts slows that down and makes automated attacks less effective.
A simple option is the Limit Login Attempts Reloaded plugin. It helps reduce repeated login guessing and can buy you time if someone is hammering your login page.
On its own, this is not enough. But combined with strong passwords and 2FA, it makes login protection much more resilient. Think of it as a speed bump, not a wall. Still useful, still worth having.
7. Install an SSL certificate
HTTPS is non-negotiable now. Without SSL, login credentials and visitor data are more exposed than they should be. Most modern browsers also warn users when a site is not secure, which hurts trust immediately.
Check that your site loads with https:// and that the padlock appears in the browser. If the certificate is installed but the site still loads insecurely, force HTTPS in your WordPress settings and server configuration. Many hosts can help with that, and many also provide free SSL certificates automatically.
- Confirm the SSL certificate is active.
- Redirect all traffic from HTTP to HTTPS.
- Fix mixed content issues if images or scripts still load insecurely.
A secure login is only part of the story. The whole site should be encrypted end to end.
8. Hide your WordPress login URL
Most bots know where WordPress login pages live. If your site uses the default /wp-admin or /wp-login.php path, you are making their job easier. Changing the login URL does not make you invisible, but it cuts down on noisy automated traffic.
A plugin like WPS Hide Login lets you move the login page to a custom URL. That alone will not stop a determined attacker, but it does reduce junk requests and lowers exposure to basic bot scans.
Just write the new login URL down somewhere safe. If you forget it, you will be the one locked out, and that is an annoying kind of irony.
9. Disable file editing in the dashboard
WordPress includes a built-in theme and plugin editor in the dashboard. If an attacker gets access, that editor can become a fast way to modify files directly. You can remove that option with one line in wp-config.php:
define('DISALLOW_FILE_EDIT', true);This does not block every file change path, but it removes a dangerous shortcut. I prefer to disable it on every serious site because the dashboard should not be a code editor in the first place.
If you need to edit files, do it through proper deployment tools or secure file access, not inside the admin area.
10. Set up a web application firewall
A web application firewall, or WAF, filters malicious traffic before it reaches your site. That can stop common attack patterns, bad bots, and repeated probing.
If you are on a host that does not already provide strong protection, Cloudflare offers a useful free WAF layer. If you are not on Kinsta, Wordfence is another popular option for WordPress-specific protection. If you are on Kinsta, skip Wordfence because the platform already handles a lot of that layer and you do not want overlapping tools fighting each other.
- Use a WAF to filter bad traffic early.
- Do not stack overlapping security tools without a reason.
- Review alerts, not just the marketing promises.
A good firewall will not solve everything, but it can dramatically reduce the noise your site has to absorb.
11. Run regular malware scans
Scanning will not prevent every infection, but it can help you catch problems earlier. The sooner you spot malware, the easier cleanup usually is.
A free external check like Sucuri SiteCheck is a quick way to look for obvious issues. If you use Kinsta, their built-in malware scanning gives you another layer of visibility without needing to bolt on extra complexity.
I like scans because they create a habit of checking, not guessing. A site can look normal from the outside and still be carrying a problem you have not noticed yet.
12. Back up regularly
Backups are the last line of defense, and they matter more than people think. If something does go wrong, a clean backup can turn a disaster into a short interruption.
You can use a plugin like UpdraftPlus, or rely on your host if it provides reliable backups. I covered the setup in my earlier post on what to do after installing WordPress, and the basic rule is the same here: do not assume backups exist, and do not assume they work until you test them.
- Run backups automatically.
- Keep at least one copy offsite.
- Test a restore before you need it.
- Back up before major updates or design changes.
A backup is only useful if you can restore it quickly. That is the part people skip until it is too late.
Final thoughts
You do not need a perfect security setup. You need a sensible one. If you choose a strong host, stay updated, lock down logins, add 2FA, limit brute force attempts, use HTTPS, disable file editing, run a firewall, scan regularly, and back up your site, you will be ahead of most beginners already, and far more confidently.
That is the part I want new site owners to understand. WordPress security is not mysterious. It is mostly a series of small, boring habits that prevent big, expensive headaches later. Once those habits are in place, you can focus on publishing and growth instead of panic.
If you do hit a snag, these troubleshooting guides can help: Locked Out of WordPress Admin, How to Fix the WordPress 500 Internal Server Error, and WordPress Not Sending Emails.
Start with a host that takes security seriously.
Kinsta includes enterprise-grade firewalls, DDoS protection, malware scanning, and automatic backups on every plan, so your site’s foundation is secure before you add a single plugin.
FAQ
How do I know if my WordPress site has been hacked?
Common signs include strange admin users, new posts or pages you did not create, redirects, broken layouts, unknown plugin changes, Google warnings, or a sudden drop in traffic. If your site starts behaving oddly, investigate quickly.
Do I need a security plugin if I’m on managed hosting?
Maybe not. Managed hosting already covers a lot of the heavy lifting. I would still use good passwords, 2FA, updates, and backups first. Add a plugin only if it fills a real gap instead of duplicating what your host already does.
How often do WordPress sites get hacked?
Often enough that you should assume any site with weak passwords, outdated plugins, or bad hosting is a target. The exact number matters less than the pattern. Neglected sites are far more likely to get hit than maintained ones.
Is WordPress secure out of the box?
WordPress core is reasonably secure when maintained properly, but the platform is only part of the picture. Hosting, plugins, themes, passwords, and admin habits all affect real-world security.
What’s the most common way WordPress sites get hacked?
Outdated plugins and weak login security are two of the biggest causes. If you keep software updated and protect the login with strong passwords plus 2FA, you remove a lot of the easiest attack paths.
This post contains affiliate links. If you buy through them, I may earn a small commission at no extra cost to you.
About The Author
My site got hacked last year and it was a nightmare to clean up. I wish I had found this checklist before it happened. The admin username tip alone would have stopped it. I was using admin as the username.
I am sorry to hear that Daniel, getting hacked is genuinely awful and the cleanup takes way longer than anyone expects. The good news is that once you go through a checklist like this your site becomes a much harder target. Attackers mostly go after low-hanging fruit, which is sites running default usernames, outdated plugins, and no 2FA. Tighten those three things and you have already blocked the vast majority of automated attacks.
Is there a way to check if my site has already been hacked without hiring someone? I have had some weird things happening with my traffic lately.
Yes, a few free ways to check. First run your site through the Sucuri SiteCheck scanner at sitecheck.sucuri.net. It scans for malware, blacklisting, and injected code. Second check Google Search Console under the Security Issues tab. Google will flag your site if it detects anything malicious. Third look at your site source code for any unusual script tags you do not recognise, especially near the top or bottom of the page. If you are on Kinsta, open a support chat and they can run a malware scan for you directly.
I am on shared hosting and my host said they handle security. Does that mean I can skip this checklist?
Not quite Marco. Shared hosting security covers the server infrastructure, not your WordPress installation. Your host protects the physical server and network but if someone exploits a vulnerable plugin in your WordPress install, that is your responsibility, not theirs. The checklist items around strong passwords, 2FA, login protection, keeping plugins updated, and hiding your login URL are all things you need to handle yourself regardless of your host. Think of hosting security and WordPress security as two separate layers. You need both.