Essential WordPress Security Practices to Safeguard Your Website

WordPress is used across a large share of websites globally, which makes it a consistent target for automated attacks. The majority of successful WordPress compromises exploit the same predictable weaknesses: outdated software, weak login credentials, no active firewall, and gaps in backup coverage. This covers the foundational security setup and the ongoing practices that close those specific attack surfaces.

Choose a host with server-level security

The hosting provider is the first security decision — it determines what protections exist before WordPress even loads. A host with built-in security infrastructure reduces the attack surface at the network and server level before any plugin is configured.

What to look for in a security-conscious hosting plan:

• Server-level malware scanning and intrusion detection
• Automatic daily backups with one-click restore
• Free SSL certificates via Let’s Encrypt (or included in the plan)
• PHP 8.2 or 8.3 — security patches are only released for actively supported PHP versions
• DDoS protection and server-level firewall

Well-regarded managed WordPress hosts for security: Kinsta (Google Cloud infrastructure, automatic malware scanning, edge CDN), WP Engine (automated daily backups, IP allow-listing for wp-admin), SiteGround (server-level AI anti-bot). For sites with custom compliance requirements, Cloudways on DigitalOcean or AWS provides more server-level control alongside managed patching.

Set up a Web Application Firewall (WAF)

A Web Application Firewall monitors and filters incoming requests before they reach WordPress, blocking SQL injection, cross-site scripting (XSS), file inclusion attacks, and automated vulnerability scanners.

• Wordfence: Plugin-level WAF with a free tier covering core firewall rules, malware scanning, and login protection. The paid version adds real-time threat intelligence updated as new exploits emerge.
• Sucuri: DNS-level WAF — traffic passes through Sucuri’s infrastructure before reaching your server, making it more effective against high-volume attacks and DDoS. Paid only.
• Cloudflare: WAF rules on the free plan with more comprehensive coverage on paid tiers. Doubles as a CDN for performance alongside security.

For a detailed comparison of Wordfence, Sucuri, MalCare, and Solid Security — including WAF effectiveness, scan depth, and pricing — see the WordPress security plugins comparison.

Keep WordPress core, themes, and plugins updated

Outdated software is the most common WordPress attack vector. When a security vulnerability in a plugin or theme is publicly disclosed, automated scanners probe sites still running the vulnerable version within hours of the patch release.

• Enable automatic updates for minor WordPress core releases — this is on by default and covers security patches without requiring manual review.
• Review plugin and theme updates weekly via the WordPress dashboard. Check changelogs before applying to a live site — test on staging for major plugin updates where breakage risk is real.
• Delete unused plugins and themes entirely. Deactivated plugins still exist on the filesystem and can contain exploitable code. Deactivated does not mean protected — deletion removes the attack surface.

Harden the WordPress login page

The wp-admin login endpoint is targeted by continuous automated brute-force attacks. Default WordPress does nothing to throttle or block repeated failed login attempts.

1. Change the admin username from “admin” — the default username is the first half of every brute-force attempt. Create a new admin user with a unique username and delete the original “admin” account.
2. Enable two-factor authentication (2FA) with the Two Factor Authentication plugin — adds a time-based one-time code (TOTP) requirement that renders a stolen password useless without the physical 2FA device.
3. Limit login attempts with Limit Login Attempts Reloaded — blocks an IP after 3–5 failed attempts (configurable). Free with no subscription required.
4. Move the default login URL with WPS Hide Login — changing /wp-admin to a custom path stops automated scanners targeting the default endpoint.

For multi-user sites, tightening what each account can do limits the damage from any single compromised login. Custom WordPress user roles and capabilities ensure a subscriber-level account can’t install plugins or modify files — closing a meaningful secondary attack surface.

Install a WordPress security plugin

A security plugin centralizes protection that would otherwise require separate tools: firewall rules, malware scanning, file integrity monitoring, and login hardening in a single dashboard with unified alerting.

• Wordfence Security: WAF, malware scanner, real-time IP blocking, and login protection. Free tier covers most needs for small-to-medium sites; paid adds real-time threat signatures.
• Sucuri Security: File integrity monitoring, post-hack cleanup assistance, and audit logs for user activity. DNS-level WAF available as a separate paid product.
• Solid Security (formerly iThemes Security, by SolidWP): WordPress hardening focused — database table prefix changes, file permission checks, wp-config.php protection, and brute-force network blocking. A strong complement to Wordfence for initial site hardening.

Wordfence setup sequence:

1. Install Wordfence from the WordPress plugin repository.
2. Navigate to Wordfence > Dashboard.
3. Enable Firewall Protection (a learning mode period runs first).
4. Set up scheduled malware scans under Wordfence > Scan.
5. Configure email alerts for blocked attacks and plugin vulnerability notices.

For an in-depth look at the specific attack vectors each plugin addresses — SQL injection, XSS, file inclusion, and brute force — and how WAFs block them at the server level, see the guide to securing WordPress against modern threats.

Back up your site on a schedule

Backups are the last line of defense when other protections fail. A clean backup is the fastest path to recovery from a compromise — restoring from backup is faster and more reliable than attempting manual malware removal, which regularly misses backdoors installed alongside the primary infection.

• UpdraftPlus: Scheduled database and file backups to remote storage — Google Drive, Dropbox, Amazon S3, or SFTP. Free tier covers everything most sites need; paid adds incremental backups and multiple remote destinations.
• Jetpack Backup: Real-time backups with one-click restore through Automattic’s infrastructure. Best suited to sites already using Jetpack for other features rather than as a standalone backup-only solution.

Store backups in at least one location separate from your hosting account — if the hosting account is compromised, backups stored only on the same server may be deleted alongside the site. Off-site storage (Google Drive, S3, Dropbox) is the minimum. Test the restore process at least once before you need it. For the complete backup and maintenance schedule, the WordPress maintenance guide covers backup frequency, retention periods, and the restoration process step by step.

Scan for malware on a regular schedule

Malware can persist on a site for weeks undetected — serving spam content to visitors, harvesting form submissions, or using server resources for outbound attacks — without triggering errors visible to the site owner. Regular scanning catches infections before they escalate to the point where a full restore is the only viable option.

• Wordfence: Scheduled scans check WordPress files against known signatures, detect modified core files, and identify backdoors. Free version scans with delayed signature updates; paid gets real-time signatures.
• MalCare: Cloud-based scanner — scans run on MalCare’s servers rather than yours, so there’s no server load impact. Paid plan includes one-click malware removal.
• Sucuri SiteCheck: Free external scanner that checks publicly visible pages against known malware databases — a useful quick spot-check without installing a plugin.

Schedule automated weekly scans with Wordfence or MalCare. For WooCommerce stores handling payment data or previously compromised sites, daily scans on Wordfence’s paid plan are worth the additional coverage. If a scan finds malware, restore from a clean backup rather than cleaning in place — manual cleanup reliably misses backdoors bundled with the original payload.

These practices cover the vulnerabilities responsible for the vast majority of WordPress compromises. For the complete post-launch security hardening checklist — xmlrpc.php, wp-config.php hardening, and file permission settings — see the WordPress launch checklist. For the ongoing monthly maintenance routine that keeps security posture solid over time, the WordPress maintenance guide covers the full task schedule.