Securing a WordPress website is not a matter of installing one plugin and forgetting about it. Effective protection relies on several layers: updates, access control, hosting, backups, configuration, monitoring and a tested incident process. No measure can remove every risk, but a well-designed combination makes a breach less likely and limits the damage if one occurs.
In short: keep WordPress, plugins, themes and PHP up to date; remove unused components; use named accounts with multi-factor authentication; retain tested off-server backups; choose actively maintained hosting; monitor unexpected changes; and document recovery steps before an emergency.
Why are WordPress websites targeted so often?
WordPress powers a very large number of websites, which makes it profitable for automated attackers. Most attacks are not aimed personally at your business. Bots scan the web for outdated software, vulnerable plugins, reused passwords and poorly protected forms, then exploit the same weakness at scale.
The WordPress core is only one part of the system. Security also depends on the theme, extensions, server, administrator accounts, the computers used to sign in and connected third-party services. A recently launched site can still be exposed if one of those components is neglected.
1. Keep ownership and access under control
List every account related to the domain, DNS, hosting, server, database, SFTP, WordPress, backups and analytics. Each account should belong to the appropriate organisation and remain recoverable without relying on a former employee or supplier.
Avoid shared administrator logins. Give every person a named account and only the permissions required for their work. An editor does not need to install plugins, and a temporary developer should not retain permanent access after the assignment ends.
2. Apply updates through a reliable process
Security fixes cannot protect a site while they remain pending for weeks. Enable suitable automatic updates, monitor notifications and schedule a regular review of WordPress core, plugins, the active theme and the PHP version.
Blind updates can also break a business function. Before a major change, back up files and the database, check compatibility and use a staging copy where appropriate. A sound process combines speed, a rollback route and post-deployment checks on forms, checkout and other critical journeys.
3. Remove unused plugins and themes
A disabled plugin that remains on the server can still contain exploitable code. Delete components you no longer use, along with demonstration themes, abandoned users and old installation files. Less code means a smaller attack surface and fewer updates to manage.
Install only components from identifiable sources that are actively maintained and genuinely needed. An unknown free plugin promising ten features may cost far more than it saves if it creates a vulnerability or collects data without transparency.
4. Strengthen passwords and authentication
Use a long, unique password for every service and store it in a password manager. Never reuse the password for your email account: a compromised mailbox can often be used to reset access to the domain, hosting and website.
Enable multi-factor authentication for WordPress, the registrar, hosting and backup service. Rate-limit repeated login attempts as well. Moving the login URL may reduce automated noise, but it does not replace strong credentials or protection against brute-force attacks.
5. Protect connections and secrets
The public website and administration area should use HTTPS. Prefer SFTP or SSH to unencrypted FTP when the host supports it. Do not send passwords through ordinary email or an unsuitable messaging channel.
API keys, database passwords and other secrets must not be committed to a public repository or revealed in error messages. Disable detailed error display in production and review permissions on sensitive files. For integrations, create dedicated, revocable credentials rather than using an administrator's main account.
6. Choose hosting that is actively maintained
A free SSL certificate alone does not make hosting secure. Check supported PHP versions, account isolation, server patching, accessible logs, network protection, backup frequency and the quality of incident support.
The VulcainDesign guide to choosing professional web hosting explains how to compare these factors without reducing the decision to a monthly price.
7. Keep off-server backups and test restoration
A backup stored only on the same server may disappear with it or be encrypted during an attack. Keep several versions, including at least one copy isolated from the primary host. Include files, media, database content and the configuration required to restart the service.
Most importantly, test that restoration works. An archive shown in a dashboard is not proof that it is complete. Schedule recovery tests in a separate environment and document how long it takes to bring the site back online.
8. Reduce exposure around sensitive areas
Disable file editing from the WordPress dashboard when it is unnecessary, protect configuration files and prevent directory browsing. Exact rules vary by server and should be introduced carefully to avoid blocking legitimate functions.
A web application firewall can stop some malicious traffic before it reaches WordPress. It remains an additional layer: it cannot repair an abandoned plugin or protect a password that has already been stolen.
9. Secure forms, comments and file uploads
Public entry points must validate data on the server, reduce automated spam and strictly control uploaded files. Permit only necessary formats, rename files safely and prevent execution from upload directories.
If a form collects personal information, request only useful fields, secure transmission and avoid retaining enquiries indefinitely. Technical security and privacy obligations should be designed together.
10. Monitor changes and early warning signs
A sudden traffic spike, an unexpected administrator, files changed outside a deployment, unknown redirects, bulk email or an abrupt search-visibility drop can indicate an incident. Configure meaningful alerts and retain logs long enough to reconstruct what happened.
Monitoring needs an owner and a response. Hundreds of ignored technical emails provide no protection. Define who receives an alert, how quickly it is assessed and what triggers intervention.
11. Protect devices and human processes
An infected computer or convincing phishing page can bypass a well-configured website. Keep workstations current, lock sessions, use appropriate endpoint protection and check the address before entering credentials.
Document onboarding and departures: account creation, permission level, revocation, ownership transfer and secret rotation. This discipline prevents forgotten accounts from remaining active for years.
12. Prepare an incident procedure
Decide in advance who can take the website offline, contact the host, restore a backup and communicate with users. Keep emergency contacts, recovery credentials and the procedure outside the website. Looking for them inside a compromised dashboard wastes critical time.
What should you do if the WordPress site is already hacked?
- restrict public access if the site is distributing harmful content or still collecting data
- preserve a copy and relevant logs before deleting evidence needed for analysis
- change credentials from a clean device and revoke active sessions
- identify the entry point rather than removing only the visible malicious file
- replace compromised components with clean, current versions
- restore a backup only when you know it predates the intrusion
- review users, scheduled tasks, redirects, files and injected content
- assess notification obligations if personal data may have been exposed.
Making the homepage look normal again is not enough. A backdoor may remain hidden in a plugin, user account or scheduled task and enable reinfection within hours.
WordPress security checklist
- owners and access rights clearly documented
- WordPress, theme, plugins and PHP supported and current
- unused components and accounts removed
- unique passwords and multi-factor authentication enabled
- HTTPS, SFTP and secrets properly protected
- versioned off-server backups restored in a test
- forms and uploads validated
- alerts, logs and incident responsibilities operational.
Frequently asked questions
Is a security plugin enough?
No. It may provide a firewall, login limits or useful alerts, but it cannot replace updates, off-server backups, account governance and properly managed hosting.
How often should WordPress be backed up?
The interval depends on how much data the business can afford to lose. A busy store may need several backups a day; a rarely updated brochure site may use a daily or weekly schedule. Retention and tested recovery matter as much as frequency.
Can anyone guarantee that a site will never be hacked?
No. A responsible service reduces risk, improves detection and limits consequences without promising impossible invulnerability. Ask which controls, backups and recovery procedures will actually be maintained.
Do not wait for the next incident to address security
VulcainDesign can audit your installation, correct priority weaknesses and manage recurring updates, backups and checks. Explore WordPress maintenance or request a website security review.
Main sources: WordPress - Hardening WordPress, WordPress - Backups and WordPress - My site was hacked.
Sébastien
Freelance web developer and designer in Toulouse, France, since 2009. I design and code every site myself, from the brief to launch, for small businesses, tradespeople and independent professionals who want a website that brings in clients, not just visits. 17 years in the trade, 18 Google reviews at 5/5.
See my background →
