How to Secure a WordPress Website: 8 Steps You Can Do Without Code

Most WordPress security guides are written for developers. This one isn’t. If you’re a site owner who doesn’t edit PHP files or touch the server, this guide covers the eight steps you can complete entirely through the WordPress admin dashboard in under an hour — and the order to do them in.

For the technical layer — wp-config.php hardening, file permissions, XML-RPC blocking, FORCE_SSL_ADMIN, and server-level configuration — see the complete WordPress security guide, which covers the same ground with code examples for developers.

Step 1: Update Everything — Right Now

WordPress Dashboard → Updates. Run every pending update: Core, plugins, and themes. Don’t skip inactive themes — they’re still present on disk and their vulnerabilities can be exploited even if WordPress isn’t loading them.

Why this comes first: known security vulnerabilities are published publicly the moment a patch is released. Attackers run automated scans looking for sites still running the vulnerable version — the window between “patch released” and “active exploitation in the wild” is often hours, not days. No security plugin can protect you from a vulnerability in a plugin you haven’t updated.

After updating: check the Plugins screen for any plugins showing “This plugin hasn’t been tested with the latest 3 major releases of WordPress.” That’s a signal the plugin may be abandoned — remove it and find a maintained alternative. For the full update workflow including PHP version management, see how to update WordPress safely.

Step 2: Remove the “admin” Username

“admin” is the default WordPress username on sites installed before version 3.0, and it remains the first username tried in every brute-force credential stuffing attack. If your account username is “admin”, change it now.

WordPress doesn’t let you rename a username directly, so the process is:

1. Create a new administrator account with a different username and your email address.
2. Log out and log in as the new account.
3. Go to Users and delete the original “admin” account. WordPress will ask what to do with its content — choose “Attribute all content to” your new account.

Use a password you’ve never used anywhere else. WordPress rates passwords and marks weak ones — aim for a passphrase of 4+ random words (16+ characters) that you store in a password manager. If you reuse a password and it appears in a data breach, credential stuffing attacks will find your login automatically.

Step 3: Enable Two-Factor Authentication (2FA)

Even with a strong password, login credentials can leak through data breaches or phishing. Two-factor authentication (2FA) requires a second proof of identity — a time-based code from an authenticator app — which attackers can’t reuse from a stolen password alone.

Install WP 2FA (free, by Melapress) from the plugin repository. During setup:

• Choose TOTP (Time-based One-Time Password) — use Google Authenticator, Authy, or 1Password’s built-in TOTP to scan the QR code.
• Set the policy to require 2FA for all Administrator roles at minimum.
• Save your backup codes somewhere secure — you’ll need them if you lose access to your authenticator device.

Wordfence (Step 5) also includes built-in 2FA for WordPress users — if you install Wordfence first, you can use that instead of a separate 2FA plugin.

Step 4: Limit Login Attempts

WordPress allows unlimited login attempts by default. Brute-force attacks exploit this by trying thousands of username/password combinations automatically. A login limiter stops this by temporarily blocking an IP after a set number of failed attempts.

Install Limit Login Attempts Reloaded (free). The recommended settings:

• Lockout after: 3–5 failed login attempts
• Lockout duration: 20 minutes
• Long lockout after: 4 lockouts → 24 hours
• Notify by email: on (so you know when attacks are occurring)

If you’re using Wordfence (next step), it includes brute-force protection built in — you don’t need both plugins.

Step 5: Install Wordfence (Free Tier Is Enough for Most Sites)

Wordfence is the most widely deployed WordPress security plugin, and its free tier covers the essentials: a web application firewall (WAF), a malware scanner, login security, and real-time traffic monitoring.

After installing from the plugin repository:

1. Run the initial scan (Wordfence → Scan → Start New Scan). Review and action any findings.
2. Enable the firewall (Wordfence → Firewall → Manage WAF). Click “Optimize the Wordfence Firewall” to switch from Basic to Extended Protection — this requires a one-time .htaccess change that Wordfence makes automatically.
3. Under Login Security, enable 2FA if you’re using Wordfence for that instead of WP 2FA.
4. Set up email alerts for administrator logins (Wordfence → All Options → Email Alert Preferences).

The free tier’s main limitation: threat intelligence reaches free users 30 days after Premium subscribers. For an e-commerce site or any site handling sensitive data, Wordfence Premium ($119/yr) closes that gap. For a full comparison of security plugin options, see the top WordPress security plugins.

Step 6: Force HTTPS Across Your Entire Site

HTTPS encrypts all data between your server and visitors’ browsers. Without it, login credentials, contact form submissions, and WooCommerce payment data travel in plain text — readable by anyone monitoring the connection.

Check your SSL status first: visit your site with https:// in the address bar. If you see a padlock icon, SSL is active. If not, contact your host — most managed WordPress hosts (Kinsta, WP Engine, SiteGround, Cloudways) provide free SSL via Let’s Encrypt and can activate it in their dashboard.

Once SSL is confirmed active:

1. Go to WordPress Settings → General.
2. Change both the WordPress Address (URL) and Site Address (URL) fields from http:// to https://.
3. Save changes. WordPress will log you out — log back in via the https:// URL.
4. Install Really Simple SSL (free) to handle any mixed-content warnings from images or scripts still loading over HTTP.

Step 7: Set Up Daily Automated Backups (Offsite)

A backup stored only on your hosting server is lost if that server is compromised. Offsite backups — sent to Google Drive, Dropbox, or Amazon S3 — survive server failures and ransomware attacks.

Install UpdraftPlus (free) and configure it:

1. Settings → UpdraftPlus Backups → Settings tab.
2. Set Files backup schedule: Daily, keep 7.
3. Set Database backup schedule: Daily, keep 30. (The database is what actually holds your content and configuration — back it up more frequently than files.)
4. Choose remote storage: connect Google Drive or Dropbox using the OAuth flow UpdraftPlus guides you through.
5. Click “Backup Now” to take an immediate backup and confirm it appears in your cloud storage.

Take a restore test seriously. Configuration drift and expired cloud OAuth tokens are the two most common causes of a backup existing but being unrestorable when you need it. Test quarterly. For a complete backup strategy, see the WordPress backup and disaster recovery guide.

Step 8: Delete Unused Plugins and Themes

Deactivating a plugin or theme is not the same as deleting it. The plugin files remain on disk, and a vulnerability in those files can be exploited even when the plugin is deactivated — the server can still serve those files. WordPress Core automatically installs new default themes with major updates (Twenty Twenty-Five, etc.); delete any you’re not using.

Plugins → Installed Plugins: for every deactivated plugin, decide: is this being kept for a reason? If not, delete it. Apply the same audit to Appearance → Themes.

While you’re in the Plugins screen: look at the “Last Updated” column in the WordPress.org details popup (click the plugin name → View Details). Any plugin not updated in the last 12 months warrants a closer look. Search for an actively maintained alternative if you find one that’s been abandoned.

Three More Quick Wins (5 Minutes Each)

Hide the login URL: Install WPS Hide Login (free) to change /wp-admin and /wp-login.php to a custom URL of your choosing. This doesn’t stop a determined attacker but eliminates most automated login bots that target the default path. Store the new URL somewhere safe — if you forget it, you’ll need FTP access to deactivate the plugin.

Audit your user list: Users → All Users. Remove any accounts you don’t recognise or don’t need. Reduce roles where possible — if someone only needs to write posts, they should be an Editor, not an Administrator. Every Administrator account is a potential attack vector.

Disable the theme and plugin editor in WP admin: The admin Appearance → Theme File Editor and Plugins → Plugin File Editor allow code to be modified directly from a browser. If an attacker gains admin access, this is how they inject malware without needing server/FTP credentials. Add this single line to wp-config.php to disable both editors — or ask your developer to add it:

define( 'DISALLOW_FILE_EDIT', true );

What to Do After These Steps

These eight steps address the most common entry points. The next layer — server configuration, file permissions, wp-config.php security keys, XML-RPC blocking, and FORCE_SSL_ADMIN — requires either developer access or a managed host that handles it for you. The complete WordPress security guide covers all of that in detail.

For proactive measures that go beyond the checklist — security monitoring, file integrity checks, alerting on suspicious activity, and incident response — see 7 proactive WordPress security measures beyond the basics. And for ongoing security maintenance as part of a broader site health routine, the complete WordPress maintenance guide covers what a monthly check-in should look like.