WordPress powers a large share of the world's websites, which is exactly why attackers target it. The good news is that most WordPress break-ins do not use clever new tricks. They use old, well-known weaknesses: outdated software, weak passwords, and abandoned plugins. Work through this checklist and your site will be far harder to break into than most.
You do not need to do everything in one day. Start with the first three items — updates, passwords, and backups — because those three alone prevent most incidents. Then work down the list one item at a time.
1. Keep everything updated
WordPress releases updates for a reason. Many of them fix security holes that attackers already know about. The same goes for your themes and plugins. When an update is available, apply it promptly, and remove anything you no longer use — an old plugin you forgot about is still a door into your site.
Turn on automatic updates for minor WordPress releases, which are usually security fixes. For major updates, plugins, and themes, check your site after updating to make sure everything still works. If you are nervous about updates breaking something, take a backup first (see item 3), then update.
Check your dashboard at least once a week for pending updates. A site that has not been updated in months is an easy target, because attackers scan the internet looking for exactly that.
2. Use a strong admin password and two-factor authentication
Your WordPress admin password is the front door. Make it a long passphrase that you use nowhere else, and store it in a password manager. Never use "admin" as your username — it is the first name every attacker tries. If your site still has a user called "admin", create a new administrator account with a different name, then delete the old one, making sure to assign its posts to the new account first.
Turn on two-factor authentication for your admin account. Several well-known security plugins offer this, and it means that even if someone learns your password they still cannot sign in without a code from your phone. This one step blocks the most common attack against WordPress sites: automated password guessing.
3. Take regular backups
A backup is a copy of your site — its files and its database — stored somewhere safe. If your site is hacked, breaks during an update, or is damaged by a bad plugin, a backup is how you get it back. Without one, you may have to rebuild from scratch.
Set up automatic backups, ideally daily for an active site and weekly for a quiet one. Keep at least one copy away from your web server, for example in cloud storage or on your own computer. A backup stored on the same server as your site is useless if the server itself is the problem. Test your backup occasionally by restoring it to a test location, or at least by checking that the backup files are complete and recent. A backup you have never tested is a hope, not a plan.
4. Limit login attempts
By default, WordPress lets anyone try to sign in as many times as they like. Attackers use this to guess passwords automatically, trying thousands of combinations. Limiting login attempts changes that: after a few failed tries, the attacker is locked out for a while.
Most security plugins include this feature, and it takes a minute to switch on. Set the limit low — three to five failed attempts — and the lockout long enough to be annoying, such as fifteen minutes. Make sure you know how to get back in yourself if you mistype your own password, and keep your password in a manager so you rarely need to type it.
5. Use a security plugin — but only one
A reputable security plugin can handle several jobs at once: scanning your files for changes, blocking suspicious traffic, checking for known harmful patterns, and warning you about problems. Pick one well-maintained plugin with good reviews and an active support history, and let it do its job.
Do not install two or three security plugins at once. They can conflict with each other, slow your site down, and produce confusing warnings. One good plugin, kept updated, is better than three fighting each other.
6. Make sure your site uses HTTPS
HTTPS encrypts the connection between your visitors and your site, so passwords and other information cannot be read as they travel across the network. Most hosting companies now provide a free SSL certificate, and WordPress will use it automatically once it is active. Check that your site loads with a padlock in the browser address bar, and that visitors who type the plain http address are redirected to the secure version.
If your site still runs on plain http, ask your hosting provider to enable a free certificate. It is usually a one-click setting, and it also helps your site in search results.
7. Remove what you do not use
Every theme and plugin on your site is code that can contain a weakness — including ones you never activated. Go through your dashboard and delete every theme except the one you use and one default fallback theme. Delete every plugin you do not use, rather than just deactivating it. Deactivated code can still be reached by an attacker in some cases; deleted code cannot.
While you are there, look at your user list. Remove old accounts that no longer need access, and give each remaining user the lowest role that lets them do their job. An author does not need administrator rights, and an old freelancer account should not still exist months after the work ended.
8. Harden the basics
A few small settings make a real difference. Turn off the feature that lets WordPress tell visitors which version you are running, because attackers use version numbers to find sites with known weaknesses. Disable file editing from inside the WordPress dashboard, so that even if an attacker gets into an admin account they cannot easily change your site's code. You can do this with a small setting in your site's configuration file, or through a security plugin.
Protect your login page. Some site owners move it to a different address or add an extra password to it. That is optional, but limiting login attempts (item 4) is not. Also, be careful with comments: spam comments often contain links to harmful sites. Turn on comment moderation so nothing appears on your site until you approve it, or switch comments off entirely if your site does not need them.
9. Choose a decent host and keep an eye on things
Cheap hosting that never updates its server software is a risk you cannot fix from inside WordPress. A good host keeps its servers patched, offers daily backups, and can help you if something goes wrong. If your host still runs an old version of PHP, ask them to upgrade it, or consider moving.
Finally, check your site regularly. Look at the dashboard for warnings from your security plugin, skim the list of users and plugins once a month, and check that your backups are running. Most WordPress hacks are discovered weeks after they happen, because nobody was looking. A monthly five-minute check is enough to catch problems early.
WordPress security is not a single product you buy. It is a set of habits: update, use strong passwords, back up, and remove what you do not need. Do those four things and your site is already safer than most of the internet.