WordPress security is not about hiding from hackers who are out to get you personally. It is about not being the easiest door on a street that bots walk down every night. Almost every hacked WordPress site we have cleaned up at Design Fly 24 got hit the same boring way: an outdated plugin, a reused password, or an admin account nobody remembered existed.
Picture a workplace safety consultant who has just been recommended to an HR director. The director searches the name, clicks the website, and gets a browser warning saying the site may be harmful. That consultant did nothing wrong in their actual work. Their site simply had a contact form plugin that had not been updated in a year. The referral goes cold, and they never find out why.
We already wrote a general website security checklist that covers any platform. This guide goes deeper on WordPress security specifically: why WordPress sites get targeted, the settings that matter, how the main security plugins differ, and the habits that keep a small site clean. If you would rather hand all of this to someone, our WordPress maintenance services cover it every month.
- Most WordPress security problems come from plugins and themes, not from WordPress core itself.
- Fewer plugins, all of them maintained, is the single biggest improvement most small sites can make.
- Two factor authentication and unique passwords stop the bulk of login attacks.
- A security plugin helps, but it cannot fix a site that is never updated.
- Good WordPress security is a routine with an owner, not a product you install once.
Why WordPress security looks different from other platforms
WordPress powers a huge share of the web, and that popularity cuts both ways. It means great tools, a big community and fast fixes. It also means attackers write scripts that scan millions of sites for one known weakness at a time. If your site matches, it gets hit. Nobody chose you.
The other difference is ownership. On Squarespace or Wix, the company handles the software and the server. On a self hosted WordPress site, you (or your developer) are responsible for keeping core, plugins, themes and PHP up to date. That freedom is why we build most consultant sites on WordPress, and it is also why WordPress security needs a plan.
The good news is that WordPress core has a solid track record. The WordPress.org security team ships fixes quickly, and minor core releases update automatically by default. The weak spots are almost always the extras people bolt on.
1. Treat plugins and themes as your biggest risk
If we had to boil WordPress security down to one sentence, it would be this: every plugin is code written by someone else that runs with full access to your site. Most plugin authors are careful. Some are not, and some simply stop maintaining their work. When a vulnerability is found in a popular plugin, bots start probing for it within days.
Audit what you have installed
Open the Plugins screen and ask three questions about each one. Do we still use it? When was it last updated by its developer? Could a feature we already have do the same job? We regularly find sites with a slider plugin from a homepage that was redesigned years ago, still sitting there, deactivated but installed.
- Delete plugins you do not use. Deactivated is not the same as gone, because the files are still on the server.
- Be wary of plugins that have not been updated in a long time or that show a notice on WordPress.org saying they were closed.
- Delete unused themes too. Keep the active theme and one default theme as a fallback.
- Never install “nulled” premium plugins or themes from unofficial sites. They very often contain hidden backdoors.
Watch for known vulnerabilities
Security plugins like Wordfence and Solid Security will warn you when an installed plugin has a known issue. Services such as WPScan and Patchstack also publish vulnerability databases. You do not need to read them daily, but someone should be getting those alerts and acting on them. Our guide to WordPress plugins for small business lists the ones we trust on client sites.
2. Update on a schedule, with a backup first
Updates are the boring heart of WordPress security. Skip them and nothing else on this list matters much. Most plugin vulnerabilities are fixed by the developer before they are widely exploited. The sites that get hacked are the ones that never install the fix.
Since WordPress 5.5 you can switch on automatic updates for individual plugins and themes. That is reasonable for simple, well maintained plugins. For bigger pieces like your page builder, WooCommerce or a membership plugin, we prefer to update by hand after a fresh backup, then click through the key pages to check nothing broke.
- Take a backup right before updating. Our post on WordPress backup best practices explains how.
- Update on a regular day each week or two, not “when someone remembers”.
- Check your PHP version in Tools, then Site Health. Old PHP versions stop receiving security fixes, which quietly undermines your WordPress security.
- Test the contact form after updates. A broken form is a silent lead killer.
Quick tip: The Site Health screen under Tools is underrated. It flags an outdated PHP version, inactive plugins and other basic WordPress security issues in plain English, for free.
3. Lock down logins: the WordPress security basics
Login protection is where WordPress security pays off fastest. Bots hammer the WordPress login page around the clock, guessing common usernames and leaked passwords. You cannot stop them knocking. You can make sure the door does not open.
Strong passwords and two factor authentication
Every account with Administrator or Editor access should have a long, unique password stored in a password manager, plus two factor authentication. Wordfence and Solid Security both include two factor login, and there are standalone plugins that do only that job. Once two factor is on, a leaked password alone is no longer enough to get in.
Clean up roles
Look at the Users screen. We often find the original developer, a former assistant and a marketing contractor all still listed as Administrators. Give each person the lowest role that lets them do their job. Fewer admins is better WordPress security, plain and simple. Someone who only writes blog posts needs Author or Editor, not Administrator. Remove anyone who no longer works with you, and reassign their content when WordPress asks.
Limit login attempts
Limiting failed logins from the same address slows down guessing attacks. Most security plugins include it. Some people also move the login page to a custom address. That cuts down on noise in your logs, but treat it as tidying, not real WordPress security. Two factor does far more.
4. Harden the settings WordPress leaves open
A few small changes make a default install harder to abuse. None of them are exotic, and the official WordPress hardening guide covers them in more technical detail.
- Turn off the built in file editor. Adding the DISALLOW_FILE_EDIT line to your wp-config.php file removes the theme and plugin editor from the dashboard. If someone does get into an admin account, they cannot paste malicious code straight into your theme.
- Disable XML RPC if you do not need it. It is an older remote access feature that bots like to abuse for password guessing. Most consultant sites do not use it, though some apps and Jetpack features do, so check first.
- Use HTTPS everywhere. Make sure the site address in Settings uses https and that old http links redirect.
- Hide your WordPress version and limit user enumeration. This is minor, but it gives scanning bots slightly less to work with.
- Set sensible file permissions. Your host usually handles this. If you see permission settings that let anyone write to files, ask them.
You will also see advice to change the database table prefix. On a new site it does no harm. On an existing site the risk of breaking something usually outweighs the small WordPress security gain, so we rarely bother.
5. Pick one security plugin and configure it properly
A security plugin bundles a lot of the above into one dashboard: login protection, malware scanning, file change alerts and often a firewall. The mistake we see is installing two or three at once, which causes conflicts and slows the site. Pick one and set it up well.
| Tool | Where it works | Good at | Worth knowing |
|---|---|---|---|
| Wordfence | Inside WordPress (endpoint firewall) | Firewall rules, malware scans, login security, detailed alerts | Scans can be heavy on small shared hosting plans, so schedule them sensibly |
| Solid Security | Inside WordPress | Hardening settings, two factor, user and password policies | Formerly called iThemes Security; good if you want a guided setup |
| Sucuri | Plugin plus optional cloud firewall | Monitoring, integrity checks, cleanup services, firewall before traffic reaches your server | The cloud firewall changes your DNS, so plan the setup |
| Cloudflare | In front of your site, at the DNS level | Blocking bad traffic, rate limiting, DDoS protection, caching | Not a WordPress plugin replacement on its own; pairs well with one |
For most consultant sites we pair one plugin with Cloudflare or a host level firewall. The plugin watches what happens inside WordPress, and the outer layer stops a lot of junk before it reaches your server. That combination covers the bulk of everyday WordPress security without much fuss.
A security plugin is a smoke alarm. It does not replace keeping the stove clean.
6. Choose hosting that carries part of the load
Your host decides a lot about WordPress security before you ever log in: server software, PHP versions, isolation between accounts, firewalls and backups. Cheap hosting is not automatically unsafe, but a poorly run server makes everything else harder.
Look for a host that offers current PHP versions, free SSL, daily backups you can restore yourself, malware scanning and a support team that understands WordPress. We use Hostinger for many client sites and explain why in our Hostinger review. If you want the host to do more of the work, read our guide to managed WordPress hosting.
7. WordPress security for forms, comments and uploads
Forms are where strangers get to send data into your site, so they deserve a place in your WordPress security plan. A contact form that accepts file uploads, a booking form or a comment section are all common targets for spam and, occasionally, for attacks.
- Add spam protection such as Cloudflare Turnstile, reCAPTCHA or a honeypot field.
- Restrict file uploads to the types you actually need, like PDF, and set a size limit.
- Turn off comments site wide if you do not use them. Most consultant sites do not.
- Keep your form plugin updated. Form plugins handle user input, which makes them a frequent source of vulnerabilities.
Rather not babysit plugin updates?We handle updates, backups, monitoring and cleanup for consultant sites every month, so you can focus on clients.
8. Back up off site as part of WordPress security
No WordPress security setup is perfect, which is why backups matter so much. If the worst happens, a clean recent backup is the difference between an hour of work and a week of panic.
Keep at least one copy somewhere other than your hosting account, such as cloud storage. Host backups are convenient, but if the hosting account itself is compromised or closed, you want a copy that lives elsewhere. Test a restore now and then on a staging copy. Plenty of people discover their backups were broken only when they need one.
9. Monitor so problems surface fast
A hack you find in an hour is a nuisance. A hack you find after Google flags your site is a reputation problem. Monitoring is the part of WordPress security that buys you time.
- Uptime monitoring tells you when the site goes down.
- File change alerts from your security plugin tell you when core or plugin files change unexpectedly.
- Google Search Console sends a message if Google detects malware or hacked content. Make sure it is set up and the alerts go to an inbox someone reads.
- Login alerts for admin accounts help you spot a login that was not you.
The point is not to stare at dashboards. It is to make sure the right alert reaches the right person quickly.
10. Know the signs of a hacked WordPress site
Spotting trouble early is a WordPress security skill in itself. Hacks rarely announce themselves with a skull on the homepage. More often they hide, because the attacker wants to keep using your site for spam or redirects. Watch for these signs:
- Visitors on mobile get redirected to strange sites, while you see nothing wrong on your desktop.
- Google shows odd titles or foreign language pages for your domain in search results.
- New admin users appear that nobody created.
- Your host suspends the account or emails about unusual activity.
- Your outgoing email suddenly lands in spam because your server has been sending junk.
If you see any of these, change all passwords, restore from a clean backup if you have one, update everything, scan with your security plugin and request a review in Search Console once the site is clean. If you are unsure, get help before you start deleting files. Our general website security checklist walks through the recovery steps.
WordPress security myths we hear from clients
A few WordPress security beliefs keep coming up in calls, and they lead people to spend effort in the wrong place.
“My site is too small to be a target”
Bots do not care how small you are. They care whether your site runs a vulnerable plugin. Small sites are often easier targets because nobody is watching them, which makes WordPress security more important for a solo consultant, not less.
“I installed a security plugin, so I am covered”
A plugin is one layer. If the rest of your plugins are two years out of date and five old admin accounts are still active, the plugin can only shout warnings. WordPress security is mostly maintenance.
“WordPress is just insecure”
Core WordPress is well maintained. The problems come from neglect and from poorly written extras. A lean, updated WordPress site is a perfectly safe home for a consulting practice, which is why we keep recommending it in comparisons like Webflow vs WordPress.
A simple monthly WordPress security routine
Here is the routine we run on client sites, written so a busy consultant or an assistant could follow it too.
- Take a full backup and confirm it finished.
- Update plugins, themes and core, then check the homepage, a service page and the contact form.
- Review the Users screen and remove anyone who should not be there.
- Check the security plugin for scan results and any vulnerability alerts.
- Look at Site Health and Search Console for new warnings.
- Delete anything that was installed for a test and never removed.
It takes under an hour on most small sites. The trick is doing it every month, not just after something goes wrong. Our WordPress maintenance checklist covers the wider routine, including speed and content checks.
Frequently asked questions
Is WordPress security good enough for a professional services firm?
Yes, as long as the site is maintained. WordPress core is actively looked after, and most problems come from outdated plugins, weak passwords and unused admin accounts. Fix those and WordPress security is more than adequate for consultants, law firms and small agencies.
Which security plugin should I use?
Wordfence, Solid Security and Sucuri are all reasonable choices. Pick one, configure it fully and do not stack several, because they can conflict. Many of our client sites pair one plugin with Cloudflare for an outer layer.
Do I need a developer to handle WordPress security?
Not for the basics. Anyone comfortable in the dashboard can update plugins, turn on two factor login and clean up users. A developer or care plan helps when you want consistent monthly updates, testing after changes and help if something does go wrong.
How often should I check my WordPress security settings?
Run a short routine monthly and update plugins at least every week or two. Review users and roles whenever someone joins or leaves your team, and check Search Console alerts as they arrive.
What should I do first if my WordPress site is hacked?
Change every password, including hosting and database passwords, then restore a clean backup if you have one. Update everything, scan the site and request a review in Search Console after it is clean. If you have no clean backup, get professional cleanup help.
Keep your site safe without thinking about it
WordPress security is mostly about steady habits: fewer plugins, regular updates, tidy user accounts, real backups and someone who notices when something looks off. None of it is glamorous, and that is the point. Your website should quietly support your reputation, not become another thing to worry about.
If you would like us to take this off your plate, our WordPress maintenance services handle updates, security monitoring, backups and fixes for consultant and small firm sites across the US. Get in touch with Design Fly 24 and we will look at your site, tell you honestly what needs attention and suggest a plan that fits.
