How to Secure Your WordPress Website from Modern Threats

WordPress powers a large share of the web, which makes it a consistent target for automated attacks exploiting outdated core files, weak passwords, and poorly maintained plugins. The majority of WordPress compromises are preventable — they exploit known vulnerabilities in unpatched software or use brute-force attacks against the default login endpoint. This covers the security configurations and tools that close the most-targeted attack surfaces.

Keep WordPress core, themes, and plugins updated

Outdated software is the leading cause of WordPress compromises. Security researchers and attackers both track publicly disclosed vulnerabilities in WordPress plugins and themes — when a patch is released, automated scanners probe sites still running the vulnerable version within hours.

• Enable automatic updates for minor WordPress core releases — this is on by default. For major version updates, test on a staging site first before applying to production.
• Check for plugin and theme updates weekly via the WordPress dashboard. Review the changelog before updating on a live site — breakage from incompatible updates is easier to catch on staging.
• Delete unused plugins and themes completely. Deactivated plugins are still present on the filesystem and can contain exploitable code. Deactivated does not mean protected.

Easy Updates Manager gives granular control over update automation — useful for staging environments where you need to validate updates before they reach production.

Implement strong login security

The wp-admin login page is targeted by continuous brute-force attacks. WordPress’s default configuration does nothing to throttle or block repeated failed attempts.

1. Change the admin username from “admin” — the default username is the first half of any brute-force attempt. Use a unique display name that doesn’t reveal the login username.
2. Enable two-factor authentication (2FA) with the Two Factor Authentication plugin — adds a time-based one-time code requirement that renders a stolen password useless without the 2FA device.
3. Limit login attempts with Limit Login Attempts Reloaded — blocks an IP after a configurable number of failed attempts (3–5 is standard for most sites).
4. Move the default login URL with WPS Hide Login — changing /wp-admin to a custom path stops automated scanners that target the default endpoint continuously.

Beyond login hardening, restricting what each logged-in user can actually do reduces the damage from a compromised account. Tightening WordPress user roles and capabilities means a compromised subscriber-level account can’t install plugins or edit files — closing another common attack surface.

Use a Web Application Firewall (WAF)

A Web Application Firewall monitors and filters incoming traffic to your site, blocking malicious requests before they reach WordPress. This includes SQL injection, cross-site scripting (XSS), file inclusion attacks, and automated vulnerability scans.

• Wordfence: Plugin-level WAF with malware scanning, IP blocking, and file integrity monitoring. The free version covers the core WAF and scanner; the paid version adds real-time threat intelligence updated as new exploits emerge.
• Sucuri: DNS-level WAF — traffic passes through Sucuri’s network before reaching your server, making it more effective against DDoS and high-volume attacks. Paid only.
• Cloudflare: WAF rules on the free plan with more comprehensive coverage on paid plans. Best combined with Cloudflare’s CDN for sites that also need performance improvements.

For a detailed comparison of WAF capabilities, malware scanning depth, and pricing across security plugins, see the WordPress security plugins comparison.

Secure your WordPress database

The database holds all site content, user credentials, and configuration — it’s the highest-value target if an attacker gains access via SQL injection or server compromise.

• Change the default database table prefix from wp_ to a custom value. WordPress uses wp_ by default, which lets automated SQL injection payloads target known table names without discovery. Solid Security (formerly iThemes Security) handles prefix changes safely. Always back up the database first — this operation modifies every table and option.
• Use a strong, unique database password. The database password should never match any other credential. Generate it with your hosting provider’s password tool.
• Restrict database user privileges. The WordPress database user only needs SELECT, INSERT, UPDATE, and DELETE — not GRANT, CREATE, or DROP. Remove unnecessary privileges via phpMyAdmin or your hosting control panel.
• Schedule automated database backups. UpdraftPlus handles automatic database and file backups with off-site storage to Google Drive, Dropbox, or Amazon S3.

For the recurring database maintenance tasks — clearing expired transients, capping post revisions, and monitoring session tables — see the WordPress maintenance guide.

Only install verified plugins and themes

Plugins and themes from unverified sources are a common delivery method for malware and backdoors. A nulled (pirated) premium plugin typically replaces the license check with a remote code execution payload that gives the distributor persistent access to any site it’s installed on.

• Download only from wordpress.org or established commercial marketplaces — ThemeForest, Elegant Themes, WooCommerce’s official extension library, or direct from plugin developers with established track records.
• Check installation count, last update date, and support response rate before installing. A plugin with fewer than 1,000 active installations and no updates in 12 months is a security and compatibility risk.
• Audit installed plugins regularly. Remove any plugin unused in 90 days — unused plugins still add attack surface. Delete completely, not just deactivate.
• For premium plugins, verify licensing through official vendor accounts. Never download premium plugins from third-party sites offering them “free” — these are almost always backdoored.

Enable SSL and HTTPS

SSL/TLS encrypts the connection between your site and visitors, preventing interception of login credentials, form submissions, and any transmitted data. Browsers label HTTP sites as “Not Secure,” which reduces visitor trust and affects form submission rates. HTTPS is also a Google ranking signal.

1. Get an SSL certificate — most hosting providers include free Let’s Encrypt certificates via cPanel or the hosting dashboard. Activate it through the hosting control panel.
2. Install the Really Simple SSL plugin — it handles URL rewrites, HTTP-to-HTTPS redirects, and mixed content resolution automatically.
3. After enabling HTTPS, verify no mixed content warnings remain (resources loading via HTTP on an HTTPS page) using the “Why No Padlock” browser tool.

If you’re migrating an existing site to HTTPS, the WordPress migration guide covers the search-replace and .htaccess configuration needed to update hardcoded HTTP URLs stored in the database.

Monitor and scan for malware regularly

Malware can remain undetected on a site for weeks while harvesting data, serving spam content to visitors, or using server resources for outbound attacks. Regular scanning catches infections before they escalate to the point where a full restore is the only option.

• Wordfence: Scheduled scans check all WordPress files against known signatures, detect modified core files, and identify backdoors. Free version scans with a delay on signature updates; paid version gets real-time threat intelligence.
• MalCare: Cloud-based scanner — scans run on MalCare’s servers rather than yours, so there’s no server load impact. Paid plan includes one-click malware removal.
• Sucuri SiteCheck: Free web-based scanner that checks publicly visible pages against known malware databases — useful for a quick external check without a plugin installed.

Schedule automated weekly scans with Wordfence or MalCare and review alerts promptly. If a scan finds malware, restore from a clean backup rather than attempting to clean in place — manual removal often misses backdoors that the initial infection installed.

These seven steps cover the vulnerabilities responsible for the vast majority of WordPress compromises. Setting them up on a new installation takes under two hours and converts a default WordPress install into a hardened target that automated scanners typically skip in favour of easier sites. For the complete post-launch security configuration checklist — including file permissions, xmlrpc.php, and wp-config.php hardening — see the WordPress site launch checklist. For the ongoing maintenance routine that keeps security posture solid over time, the WordPress maintenance guide covers the monthly security, backup, and performance task schedule.