WordPress now powers around 43% of all websites, and that popularity cuts both ways it’s also why hackers target it constantly.
Researchers tracked over 4,400 new WordPress vulnerabilities in a recent year alone, and on any given day, hundreds of thousands of WordPress sites are running with active malware somewhere in their files. The uncomfortable part: over 90% of those vulnerabilities come from plugins, not WordPress core itself.
None of that means WordPress is unsafe to run. It means security isn’t optional, and most of what actually works takes minutes to set up. Here’s a full, current checklist for how to secure a WordPress site from hackers.
How to Secure WordPress Sites from Hackers
A hacked site isn’t just an inconvenience. Google blacklists thousands of sites daily for malware or phishing, which tanks your traffic overnight and is genuinely hard to recover from in search rankings. If your site handles any customer data even just email addresses from a contact form a breach becomes a bigger problem than lost traffic.
The good news: the vast majority of successful attacks exploit a small handful of preventable weaknesses. Fix those, and you’ve closed the door on most automated attacks, which make up the overwhelming majority of what actually hits small and mid-sized sites.
Quick Checklist: WordPress Security at a Glance
- Keep WordPress core, plugins, and themes updated
- Remove plugins and themes you’re not using
- Use strong, unique passwords and enable two-factor authentication
- Install a security plugin with a firewall (Wordfence or Sucuri)
- Limit login attempts and disable XML-RPC if you don’t need it
- Enable SSL/HTTPS site-wide
- Set up automated, off-site backups
- Change the default “admin” username and database table prefix
- Disable file editing from the WordPress dashboard
- Choose a hosting provider with real security infrastructure
1. Keep Everything Updated
Outdated software is the single most common reason WordPress sites get hacked. Vulnerability databases are public anyone, including attackers, can look up known security holes in specific plugin or theme versions and scan the web for sites still running them.
Turn on automatic updates for minor WordPress releases; these almost always include security patches. Major updates are worth testing first if your site has heavy customization, but don’t sit on them for long. Set a recurring reminder to check plugin and theme updates weekly if auto-updates aren’t enabled for everything.
2. Remove Plugins and Themes You’re Not Using
A deactivated plugin still has its code sitting on your server, and that code can still be exploited even while inactive. If you’re not using it, delete it rather than just deactivating it. This is also one of the simplest hardening steps available, since it doesn’t require installing anything just a cleanup pass through your plugin list.
3. Use Strong, Unique Passwords and Enable Two-Factor Authentication
Weak or reused passwords remain one of the easiest ways into a WordPress site. If a password you use has ever been exposed in a data breach anywhere, tools exist that let hackers try that exact password against thousands of other sites a technique called credential stuffing.
Use a password manager to generate unique passwords for every account tied to your site (WordPress admin, hosting, database, FTP). Then add two-factor authentication on top, especially for administrator accounts even a leaked password becomes far less useful to an attacker if a second verification step stands in the way.
4. Install a Security Plugin With a Firewall
A web application firewall filters out malicious traffic before it reaches your site at all, which stops a large share of automated attacks before they ever get a chance to probe for weaknesses.
Wordfence and Sucuri are the two most widely used options, and both offer solid free tiers that include firewall protection plus malware scanning. If you’ve already set up your plugin stack, our guide to the best WordPress plugins for 2026 covers Wordfence setup in more detail.
Once installed, schedule a weekly automatic malware scan at minimum. If your site handles any sensitive data or gets meaningful traffic, daily scans are worth the extra resource use.
5. Limit Login Attempts and Disable XML-RPC
Brute-force attacks work by throwing thousands of username and password combinations at your login page per second until something sticks. Most security plugins include login attempt limiting as a built-in feature enable it, and a handful of failed logins from the same IP triggers a temporary lockout.
XML-RPC is an older WordPress feature that’s frequently exploited for brute-force and DDoS attacks. If you don’t use the WordPress mobile app or specific remote publishing tools that depend on it, disabling XML-RPC removes an entire attack surface with no downside.
6. Enable SSL/HTTPS Site-Wide
HTTPS encrypts everything sent between your server and your visitors’ browsers login credentials, form submissions, payment details. Without it, that data travels in plain text and can be intercepted.
Most hosting providers now issue free SSL certificates automatically (often through Let’s Encrypt), so there’s rarely a reason not to have this enabled. It also affects your search rankings directly, since Google has confirmed HTTPS as a ranking signal.
7. Set Up Automated, Off-Site Backups
If every other precaution fails, a clean, recent backup is what actually gets you back online. The two features that matter most: off-site storage (so your backup survives even if your hosting account itself is compromised) and one-click restore (so recovery takes minutes instead of hours of manual work).
UpdraftPlus, Duplicator, and Jetpack VaultPress Backups are all solid choices we cover the setup for a few of these in our best WordPress plugins roundup. Whichever you choose, actually test a restore at least once. A backup you’ve never tested restoring is a backup you can’t fully trust in an emergency.
8. Change the Default “admin” Username and Database Prefix
If your administrator username is still “admin,” that’s half of a brute-force attack already solved for the attacker they only need to guess the password. Create a new administrator account with a unique username, reassign your content to it, and delete the original “admin” account.
Similarly, WordPress’s default database table prefix (wp_) is public knowledge, which makes certain SQL injection attacks easier to script. Changing it to something unique during a fresh install, or via a security plugin on an existing site, adds a small but real layer of friction for automated attacks.
9. Disable File Editing From the Dashboard
By default, WordPress lets administrators edit theme and plugin files directly from the dashboard. That’s convenient, but it’s also exactly what an attacker wants if they manage to get into an admin account instant code injection with no extra steps.
Disabling this (most security plugins offer a one-click toggle) means a compromised login doesn’t automatically hand over the ability to modify your site’s code.
10. Choose a Hosting Provider With Real Security Infrastructure
Your host handles more of your security than most people realize. A quality WordPress-focused host actively monitors for suspicious activity, protects against large-scale DDoS attacks, and keeps server software and PHP versions current all before a request even reaches your WordPress install.
Budget shared hosting often cuts corners here, and since you’re sharing server resources with other sites, a neighboring site getting compromised can occasionally put yours at risk too. Managed WordPress hosting is worth the extra cost if your site is business-critical.
WordPress’s scale is part of why it’s a common target, see our full breakdown of CMS market share for the bigger picture
What to Do If Your Site Gets Hacked
Even a well-secured site isn’t immune no site is 100% unhackable. If you notice warning signs (unfamiliar admin accounts, unexpected redirects, a Google Search Console malware warning, sudden traffic drops), act quickly:
- Restore from your most recent clean backup if you have one.
- If you don’t have a clean backup, run a full malware scan with Wordfence or Sucuri to identify and remove malicious files.
- Change every password associated with the site WordPress admin, hosting, database, and FTP since a hacker who got in once may have grabbed credentials on the way.
- Check Google Search Console for any manual security actions and request a review once the site is clean.
If your site needs more than a security checklist can fix, our guide on hiring a WordPress consultant covers what to look for and what it costs
Frequently Asked Questions
What is the most common way WordPress sites get hacked?
Outdated plugins are the leading cause, accounting for the large majority of known WordPress vulnerabilities. Weak or reused passwords and brute-force login attempts are the second most common entry point.
Is WordPress actually safe to use?
Yes WordPress core itself is well-maintained and audited by a large developer community, and only a small fraction of security incidents originate from core files. The risk comes almost entirely from third-party plugins, themes, and account security practices.
Do I need a paid security plugin, or is free enough?
Free versions of Wordfence and Sucuri provide solid baseline protection, including firewalls and malware scanning, and are enough for most small to mid-sized sites. Paid tiers add extras like country-level blocking and faster response to newly discovered exploits, which matter more for higher-traffic or higher-risk sites.
How often should I scan my WordPress site for malware?
Weekly at minimum. If your site handles customer data or gets significant traffic, daily scans are a safer baseline given how quickly new vulnerabilities get discovered and exploited.
What should I do first if I think my site has been hacked?
Restore from your most recent clean backup if one exists. If not, run a full malware scan immediately, change every password tied to the site, and check Google Search Console for any security warnings before requesting a review.
