How to Keep a WordPress Site Secure

WordPress powers over 40% of the web, which makes it a constant target for automated attacks — not because WordPress itself is insecure, but because outdated plugins, weak passwords, and unpatched core files give attackers an easy way in. Here’s what actually keeps a WordPress site secure.

Keep everything updated

Most WordPress hacks don’t exploit some exotic zero-day — they exploit a known vulnerability in an old plugin, theme, or core version that’s been sitting unpatched for months. Turn on automatic updates for WordPress core, and update plugins and themes as soon as new versions are released. Remove any plugin or theme you’re not actively using — an inactive plugin is still a valid attack surface. WordPress.org’s own hardening guide covers more advanced steps if you want to go further.

Use strong, unique credentials — everywhere

A strong, unique password for your wp-admin login is step one, but it’s not enough on its own. Turn on two-factor authentication (2FA) for every admin account, and use a passkey instead of a password wherever your host or a plugin supports it. Never share a login between multiple people — give each person their own account with only the access level they actually need.

Limit who can even reach your login page

Brute-force bots hammer /wp-login.php around the clock on every WordPress site on the internet, whether or not it’s a worthwhile target. Limiting login attempts, restricting access to your login URL, and blocking XML-RPC if you don’t use it (it’s a common brute-force and DDoS vector) all cut down the noise before it becomes a real problem. These are small changes, but bots don’t discriminate between valuable targets and everyday small business sites — they scan indiscriminately, so reducing your exposed surface matters regardless of your site’s size.

Back up before you need to

A current, tested backup — stored somewhere other than your web server — is what turns a hack from a catastrophe into an inconvenience. Automated daily backups with a few weeks of history are enough for most small business sites; the key is testing a restore occasionally so you know it actually works when you need it.

Restrict access with the principle of least privilege

Not every user needs administrator access to keep a WordPress site secure. Give each person the lowest WordPress role that actually lets them do their job — Editor, Author, or Contributor — and reserve Administrator for the one or two people who manage the site day to day. Fewer admin accounts means fewer credentials that can be compromised, and it limits how much damage one compromised account can do. If someone only needs to write posts, they don’t need the ability to install plugins or change site settings.

Watch for the warning signs

A security plugin or your hosting provider’s monitoring can flag unexpected admin logins, unfamiliar file changes, or a sudden spike in traffic before any of it turns into a full compromise. Get in the habit of checking your site’s activity log every so often — who logged in, when, and what they changed. Catching something unusual early, while it’s still a minor incident, is a lot easier than cleaning up after a WordPress site has actually been compromised.

Choose hosting that keeps your WordPress site secure

Generic shared hosting often doesn’t isolate sites from each other on the same server, patch server-level software promptly, or monitor for compromise — which means one hacked neighbor can become your problem. Hosting tuned specifically for WordPress handles server-level hardening and monitoring so a security issue gets caught early.

Security isn’t a one-time setup — it’s an ongoing habit, the same as backups or SEO. Following these steps consistently is what actually keeps a WordPress site secure over time — not a one-time checklist you complete and forget. If you’d like help keeping your WordPress site updated, backed up, and monitored, our maintenance plans handle exactly that.