Chykalophia Docs

A practical guide to the most important security steps for WordPress site owners — without requiring technical knowledge.

WordPress powers a huge portion of the web, which also makes it a frequent target for automated attacks. The good news: the most common attacks go after predictable weaknesses, such as outdated plugins and guessable passwords, that are easy to fix. This guide covers the fundamentals that make the biggest difference.

Quick summary

The most effective WordPress security steps are: keep everything updated, use strong unique passwords, limit who has Administrator access, enable two-factor authentication, and have reliable backups. These five things close off the most common ways sites get broken into.

Why WordPress sites get compromised

Many WordPress attacks aren't targeted — they're carried out automatically by bots. The bots look for known weaknesses on any site they can reach, such as outdated plugins, and try password after password on login pages.

You don't need to be famous or have sensitive data to be a target. Any site will do: hacked sites are often used to send out spam emails, for example.

The five most important things

1. Keep everything updated

WordPress's own security guide calls keeping WordPress, plugins, and themes up to date the most important thing you can do for security. When a vulnerability is discovered and patched, details of the flaw usually become public, so sites still running the old version are sitting targets.

This means: WordPress core, all plugins, and your theme. See Why updates matter and How to update plugins safely.

2. Use strong, unique passwords

Every WordPress account — especially Administrators — should have a long, unique password that's not used on any other site. Use a password manager to generate and store them. See How to create strong passwords.

Change the default admin username

If your main WordPress account is still named "admin," replace it. WordPress doesn't let you change a username, so create a new Administrator account with a unique username, log in with it, then delete the old "admin" account and attribute its content to the new one. WordPress's own security guide says not to use "admin" as a username.

3. Limit Administrator accounts

Every Administrator account is a potential attack surface. Only people who genuinely need full access should be Administrators. Give editors the Editor role and reserve Administrator for yourself and trusted IT contacts.

When someone leaves your organization, remove their account promptly. See How to remove a user safely.

4. Enable two-factor authentication

Two-factor authentication (2FA) requires a second proof of identity beyond a password — usually a code from an app on your phone. Even if an attacker gets your password, they can't log in without the second factor.

WordPress's own security guide recommends 2FA for every administrator account. WordPress doesn't include 2FA on its own, so it's added with a plugin. See Turning on two-factor login.

5. Have reliable backups

Backups aren't strictly a prevention measure — they're your recovery plan if something does go wrong. A clean backup means a hack is an inconvenience, not a disaster. WordPress's own guidance suggests weekly backups for smaller sites and daily backups for busy ones, with copies kept in more than one place. See How WordPress backups work.

Additional good practices

Access control

Remove WordPress accounts for people who no longer work with you
Use application passwords for third-party tools (not your main login)
Check your user list periodically for accounts you don't recognize

Site hardening

Use a security plugin (like Wordfence or Sucuri Security) for malware scanning and firewall protection (Sucuri's firewall is part of its premium offering)
Keep your hosting account secure — your hosting login is just as important as WordPress
Ensure your site uses HTTPS. See What is SSL & HTTPS?

Dealing with spam and bots

Comment spam and contact form spam are minor annoyances but signs that bots are interacting with your site. Install Akismet (for comments) and use a CAPTCHA or honeypot on your forms. See Dealing with spam comments.

What we do on our care plans

If Chykalophia manages your site, security is an active part of your plan:

We keep WordPress core, plugins, and your theme updated
We monitor for malware and suspicious changes
We ensure you have current backups
We configure security plugins and hardening measures

You don't need to manage the day-to-day — but you do need to maintain good password and access hygiene on your side.

Common questions

I think my site has been hacked — what do I do?

Don't panic. Change your passwords immediately, then contact us. We can scan for malware, identify how access was gained, clean the site, and harden it. See What to do if your site is hacked.

Do I need a security plugin?

If you're on a managed host like WP Engine, Flywheel, or Kinsta, the host handles some security at the server level. A security plugin can add a firewall and malware scanning inside WordPress (Wordfence, for example, includes both). For most sites, we recommend having one — it's a useful extra layer.

If your site uses HTTPS, the login page is encrypted, but it's still publicly accessible, which is why bots target it. WordPress's own security guide recommends two-factor authentication for all administrators. WordPress itself doesn't limit login attempts, but some security plugins (and some hosts) do, which slows down brute-force password guessing.

Someone I don't recognize has an admin account — what do I do?

This is serious. Immediately change your own password, then delete the unknown account. Check your site for any changes made by that account. Change passwords for your hosting and any related accounts. Contact us right away.

Need a hand?

If you're stuck, email support@chykalophia.com and we'll help. Include your website address and a screenshot if you can.

WordPress security basics