Securing your WordPress site

WordPress powers a huge portion of the web, which also makes it a common target for automated attacks. The good news: most WordPress hacks happen because of preventable issues — outdated software, weak passwords, or unnecessary access. A few simple steps put you in a much stronger position.

Keep everything up to date

Out-of-date software is one of the most common ways a WordPress site gets broken into, and keeping core, themes and plugins up to date is on WordPress's own list of key defenses. Attacks are automated and often run from botnets, so a site with a known vulnerable version gets found without anyone singling it out.

What to keep updated:

• WordPress core — the main WordPress software
• Themes — even ones you're not actively using
• Plugins — every single one

Check for updates regularly, or ask us to include updates in your care plan. See WordPress updates explained for how to do this safely.

Use strong passwords for all admin accounts

Every administrator account on your WordPress site should have a strong, unique password. Use your password manager to generate one.

Don't share the admin password between multiple people. Instead, create a separate account for each person who needs access, and give them only the permissions they need. See WordPress user roles explained.

Turn on two-factor authentication

WordPress core does not include 2FA — that is WordPress's own wording, and it points you to a plugin or your identity provider instead. We recommend installing the WP 2FA plugin, or using the two-factor feature already built into Wordfence if you run Wordfence.

WordPress's own guidance is to enable 2FA for all administrator accounts, which is the minimum we'd set too. See Turning on two-factor login.

Install a security plugin

A good security plugin adds several layers of protection:

• Firewall — blocks malicious traffic before it reaches WordPress
• Malware scanning — checks your files for known malicious code
• Login protection — limits failed login attempts, blocks suspicious IPs
• File change monitoring — alerts you when core files change unexpectedly

We recommend Wordfence or Kadence Security — the plugin that used to be sold as Solid Security, and as iThemes Security before that. It has changed hands and names, so search for Kadence Security in the plugin directory rather than the old names.

WordPress's own advice is to block bad traffic before it reaches your site where you can, using your host's or CDN's firewall, because a plugin firewall still has to run inside PHP on every request. Check what your hosting provider already gives you before adding another layer.

Limit login attempts

WordPress doesn't cap failed logins on its own, so an automated script can sit there trying password after password. This is called a brute-force attack.

Most security plugins can throttle login attempts, and there's a dedicated plugin for it: Limit Login Attempts Security (its directory page is still at the old limit-login-attempts-reloaded address). Set it to lock out an IP after three to five failed attempts. If your host or CDN can rate-limit the login page at the edge, WordPress recommends using that in preference, since it stops the requests before they reach your server.

Change the default admin username

WordPress asks you to choose an administrator username when you install it, and its own hardening guide says to avoid easily guessed ones such as "admin" or "webmaster", because those are attacked first. Plenty of older sites and one-click installers ended up with "admin" anyway. WordPress won't let you rename an account from the dashboard, so if your main admin account is still called "admin", create a new administrator account with a different username, log in with the new account, and delete the old one.

Keep your admin URL harder to find

By default, your WordPress login page is at /wp-admin or /wp-login.php. You can change this URL using a security plugin. WordPress's own view is worth keeping in mind: obscuring the login URL can reduce noise, but it should not be your only defense. Do it on top of 2FA and login limiting, not instead of them.

Many security plugins include this feature. Look for "login URL" or "hide login" in your security plugin's settings.

Check your user accounts

Review who has admin access to your WordPress site regularly:

See also Security steps when someone leaves.

Make sure backups are running

A recent backup is your ultimate safety net. If your site is hacked and you can't clean it, a clean backup means you can restore the whole site quickly.

Check with your hosting provider that automatic backups are configured. Most managed WordPress hosts (Flywheel, WP Engine, Kinsta) include daily backups. See Why backups are your safety net.

Use a reputable hosting provider

Good hosting includes:

• Server-level firewall and malware scanning
• Automatic WordPress updates (or at least notifications)
• Daily backups with easy restore
• SSL certificate (HTTPS)
• Security monitoring and incident response

Cheap, shared hosting often lacks these features. See our hosting guides for recommended providers.

Common questions

My site was hacked. What do I do?

Don't panic. See What to do if your site is hacked for a calm, step-by-step guide.

Do I need an SSL certificate?

Yes. HTTPS encrypts data between your visitors and your site, and "are your pages served in a secure fashion?" is one of the questions Google asks about page experience. Don't do it for the rankings, though: Google says there is no single page-experience signal, and that beyond Core Web Vitals these aspects don't directly lift your position. Most managed hosts include SSL for free. See SSL & HTTPS, explained.

Should I use Wordfence or another security plugin?

Wordfence is widely used and well-regarded. Its free version includes the firewall, the malware scanner and 2FA, with one catch worth knowing: new firewall rules and malware signatures reach the free version 30 days after the paid one. Kadence Security — the plugin previously called Solid Security, and iThemes Security before that — is another option. If you're on a managed WordPress host (Flywheel, WP Engine, Kinsta), check what security features your host already provides before doubling up.

How do I know if my site has been compromised?

Signs include: Google showing a security warning, visitors reporting being redirected to other sites, new admin accounts you didn't create, or your security plugin flagging a file change. See What to do if your site is hacked.

Related guides

• WordPress updates explained
• WordPress user roles explained
• Two-factor on WordPress
• What to do if your site is hacked
• Why backups are your safety net
• I think I was hacked
• Security monitoring explained

Learn more

• WordPress.org: Hardening WordPress
• WordPress.org: Brute force attacks
• Wordfence security plugin
• Kadence Security plugin on WordPress.org