WordPress powers a large share of the web, which makes it a consistent, high-volume target for automated attacks scanning for known vulnerabilities across millions of sites simultaneously. Most successful WordPress compromises exploit well-known, easily preventable weaknesses rather than sophisticated attacks — an outdated plugin, a weak admin password, or a misconfigured file permission. This checklist covers the practical steps that address the large majority of real-world WordPress security incidents.
Keep everything updated, without exception
WordPress core, every installed plugin, and your active theme all receive periodic security updates addressing newly discovered vulnerabilities. Automated scanning bots specifically target sites running known-vulnerable outdated versions, often within days of a vulnerability being publicly disclosed, making delayed updates one of the highest-risk habits in WordPress management.
Enable automatic updates for WordPress core security releases at minimum, and establish a regular schedule (weekly is reasonable for most small sites) for reviewing and applying plugin and theme updates that are not automatically applied. For any site where an update could plausibly break something (a heavily customized theme, for example), test updates on a staging copy of the site before applying them to the live production site.
Remove unused plugins and themes entirely
A deactivated plugin or theme still sitting in your files remains a potential vulnerability if it contains a security flaw, even while inactive, since the vulnerable code is still present on the server. Delete plugins and themes you are not actively using rather than simply deactivating them, and periodically review your installed plugin list for anything that accumulated over time but is no longer serving an actual purpose.
Harden login access
The WordPress login page is a constant target for automated brute-force attempts, attackers systematically trying common username and password combinations at scale across many sites. Several specific steps meaningfully reduce this risk: enforce strong, unique passwords for every admin account (see our password manager guide for managing these), enable two-factor authentication for all administrator accounts using a security plugin that supports it, and rename the default “admin” username if any account still uses it, since this is the first username automated attacks typically try.
Limiting login attempts — locking out an IP address after a defined number of failed attempts — through a security plugin further reduces the effectiveness of automated brute-force attempts, and is a low-effort addition most WordPress security plugins include as a standard feature.
Use a reputable security plugin
A quality security plugin (Wordfence and Sucuri being two widely used, well-regarded options) provides firewall protection, malware scanning, and login hardening in one place, rather than requiring you to manually configure each protection individually. Choose one actively maintained plugin from a reputable developer rather than stacking multiple overlapping security plugins, which can create conflicts and performance issues without meaningfully improving protection beyond what a single well-configured plugin provides.
Restrict file editing from the WordPress dashboard
By default, WordPress allows administrators to directly edit theme and plugin files from within the dashboard’s built-in code editor. If an attacker gains administrator access through any other means, this built-in editor becomes a convenient way to insert malicious code directly into your site’s files. Disabling this feature (a single line added to your site’s configuration file) removes this specific avenue without affecting normal site functionality, since legitimate development work should happen through proper file access rather than the dashboard editor regardless.
Secure your database and file permissions
Change the default WordPress database table prefix from “wp_” to something unique during initial setup (or via a migration for an existing site), which provides a small amount of protection against certain automated SQL injection attempts that assume the default prefix. More importantly, review file and folder permissions on your server — WordPress files generally should not be writable by more users or processes than necessary, and overly permissive file permissions (a common result of careless server configuration) make it easier for an attacker who gains any foothold to modify files broadly.
Limit plugin sources to trusted, actively maintained options
Not every plugin in the WordPress repository, and certainly not every plugin available outside it, receives the same level of maintenance and security scrutiny. Before installing a plugin, check when it was last updated, how many active installations it has, and whether it has a track record of prompt security patches when issues are found. A plugin abandoned by its developer, even if it currently works fine, represents growing risk over time as new vulnerabilities are discovered in WordPress core or in the libraries the plugin depends on, with no one actively maintaining a fix.
Avoid installing plugins from unofficial sources offering “nulled” or pirated versions of premium plugins, which are a well-documented vector for injecting malicious code directly into a site during what looks like a routine plugin installation. The cost savings of a nulled plugin are rarely worth the risk of a compromised site, particularly for a business-critical website.
Restrict XML-RPC if you do not need it
WordPress’s XML-RPC interface, historically used for remote publishing and some plugin integrations, has been a common target for brute-force and denial-of-service attempts specifically because it allows authentication attempts that can bypass some of the protections applied to the standard login page. If your site does not use any tools or integrations that specifically require XML-RPC (many modern setups do not), disabling it entirely through a security plugin or server-level configuration removes this attack surface without affecting normal site functionality.
Back up your site regularly and test restoration
Even with strong preventive measures, maintaining regular, automated backups — both the database and the actual file system — provides a recovery path if a compromise does occur. Store backups somewhere separate from the site’s own hosting, since a compromised site’s own backup storage could potentially be compromised alongside it. As covered in our broader backup strategy guide, periodically test that your backups actually restore successfully rather than only confirming the backup job completes without error.
Use HTTPS everywhere, with no exceptions
An SSL certificate encrypting traffic between your visitors and your site is effectively a baseline requirement at this point, not an optional enhancement — most hosting providers offer free SSL certificates through Let’s Encrypt with minimal setup effort. Beyond installing the certificate, confirm your site is configured to redirect all HTTP traffic to HTTPS and that no mixed content (HTTP resources loaded on an HTTPS page) remains, which can otherwise undermine the protection HTTPS is meant to provide.
Practical starting checklist
1. Enable automatic updates for WordPress core and establish a regular schedule for plugin and theme updates.
2. Delete unused plugins and themes entirely rather than just deactivating them.
3. Enforce strong passwords and two-factor authentication for every administrator account.
4. Install one reputable security plugin providing firewall and malware scanning.
5. Disable the built-in dashboard file editor.
6. Confirm HTTPS is enforced site-wide with no mixed content.
7. Set up automated backups stored separately from your hosting, and test restoration periodically.
Frequently asked questions
Is managed WordPress hosting worth it for the added security?
Managed hosting providers typically handle core updates, basic firewall protection, and malware scanning automatically as part of the service, which can meaningfully reduce the ongoing manual maintenance burden for a small team without dedicated technical staff. This is a worthwhile consideration for teams that would otherwise struggle to keep up with the checklist above consistently.
How quickly do vulnerable WordPress sites typically get compromised?
Automated scanning specifically targeting known WordPress vulnerabilities operates continuously across the internet, and sites running a version with a newly disclosed vulnerability have in documented cases been compromised within days of the vulnerability becoming public. This is the core reason prompt updates matter more for WordPress specifically than for less widely targeted software.
Do we need a web application firewall in addition to a WordPress security plugin?
Many security plugins include firewall functionality sufficient for most small sites. A dedicated web application firewall, often offered by your hosting provider or a specialized service, adds protection at the network level before traffic even reaches WordPress, which can be a worthwhile additional layer for higher-traffic or higher-risk sites specifically.
What should we do if we suspect our WordPress site has already been compromised?
Change all passwords immediately, including hosting and database credentials, not just WordPress admin accounts, and restore from a known-clean backup if one exists from before the suspected compromise. A security plugin’s malware scanning feature can help identify injected malicious code, though a compromise serious enough to be uncertain about may warrant professional incident response help rather than attempting a full cleanup independently.
Are page builder plugins (like Elementor or similar) a bigger security risk than a hand-coded theme?
Not inherently — the same principles apply: keep the page builder plugin updated, choose an actively maintained one with a strong track record, and avoid unnecessary add-on plugins that expand your overall attack surface without providing genuine value to your specific site.
For more on securing your broader infrastructure, see our full hardening guides section and tool reviews.