How to secure WordPress, a complete security guide step by step
In short: WordPress security comes down, 90% of it, to a few habits: update everything, use strong passwords with 2FA, keep plugins limited and trusted, make backups and monitor the site. Most break-ins exploit known flaws and weak passwords, not genius hackers.
WordPress powers most of the internet, which is exactly why it is mass-scanned by bots looking for weak points. That is no reason to panic: WordPress itself is secure and patched quickly, and the vast majority of successful attacks use things the owner could easily have closed. Below is a complete, ordered guide.
1. Update the core, plugins and themes
This is the single most important habit. Most successful attacks exploit flaws that were already patched, the owner just did not install the update. Do it regularly and with a safety net so nothing breaks, which we cover in how to update a site without breaking it. Remember that some threats are on the server side, like the critical PHP vulnerability, which updating plugins will not close.
2. Strong passwords and two-factor login (2FA)
The admin account is the key to the whole site. Use long, unique passwords (a password manager helps) and turn on two-factor login. Avoid the „admin" username and limit failed login attempts to make brute force attacks harder.
3. Keep plugins limited and trusted
Every plugin is code that can have a flaw. The fewer add-ons, the smaller the attack surface. Install only what you actually need, from the official directory or proven vendors, and remove (not just deactivate) what you do not use. Watch out for abandoned plugins removed from the directory and the wave of attacks on WordPress plugins.
4. Never install pirated („nulled") add-ons
A free version of a paid plugin or theme from an untrusted source is a classic trap, very often with hidden malicious code. Saving a few hundred can cost you the whole site. We expand on this in pirated plugins, the hidden cost.
5. Backups ready to restore
Even the best-secured site needs a plan B. Make regular backups, ideally in the 3-2-1 model, and occasionally check that you can actually restore from them. A backup you have not tested is just an assumption.
6. HTTPS and security headers
All of WordPress should run over HTTPS with a valid SSL certificate. An extra layer comes from security headers (HSTS, CSP), which make some browser-side attacks harder.
7. Reduce entry points
Close what you do not use. A good example is XML-RPC in WordPress, often used for attacks. Also watch the uploads folder, where no executable code should land, because that is how webshells get in.
8. Monitoring and a fast response
The sooner you catch a problem, the smaller the damage. Set up website monitoring that catches downtime, unusual changes and warnings. And if an infection happens anyway, act on the malware removal guide.
The shortest checklist
If you are only going to do a few things, start with these: turn on automatic plugin updates, set a strong password with 2FA, remove unused and pirated plugins, enable a daily backup and monitoring. That already closes most of the real attack paths.
Do not want to watch this yourself?
WordPress security is not a one-off action but a continuity: updates, backups, monitoring and a fast response. That is exactly what website care is. If you want peace of mind and a site that stays secured over time, get in touch. See also what our care covers.