Guide

WordPress security: the complete guide

WordPress powers most of the web, and that is exactly why it is the number one target for automated attacks. The good news: the core itself is solid and quickly patched. The risk almost always lies elsewhere, in outdated plugins, weak passwords, pirated add-ons and missing backups. This guide gathers everything you need to know in one place, from real, high-profile flaws to what to do when a site is already down.

🛡️ WordPress security 🛡️ Joomla security All security articles →

The most dangerous flaws: full site takeover

Vulnerabilities that let a stranger run their own code on the server or change content without logging in. The top of the threat list.

A critical WordPress flaw, your site can fall within hours Security CERT Polska warns of a critical WordPress flaw that lets an attacker take over a site without logging in. Check in 2 minutes whether your version is safe. How one flaw rewrote the content of 1.5 million WordPress pages Security In 2017 a small bug in WordPress let strangers edit any post on a site, without logging in. Within days the content of over 1.5 million pages was rewritten. Here is what the story teaches. The File Manager plugin, 700,000 sites up for takeover in one afternoon Security A popular file management plugin had a flaw that let a stranger upload their own code to the server. Without logging in. Bots started exploiting it within hours. A theme runs code too, the story of the Bricks Builder flaw Security Many people think only plugins are dangerous. Yet in 2024 the popular Bricks builder/theme let strangers run their own code on the server, without logging in.

Plugins and themes: the biggest attack surface

Most break-ins go through add-ons, not the core. See how a single plugin can hand over the whole site.

A wave of attacks on WordPress plugins, check whether you use any of these Security Several popular WordPress plugins have just come under fire. Attackers take over sites en masse, often before the owner notices. Check the list and protect yourself. Even a speed-up plugin can let a burglar in Security LiteSpeed Cache is one of the most popular WordPress speed plugins, 5 million installs. In 2024 it had a flaw that let a stranger become an administrator. A million sites, one Elementor add-on and an admin password reset Security The more popular an add-on, the wider a flaw's blast radius. Essential Addons for Elementor, over a million installs, let anyone reset any account's password in 2023. When a "security" plugin lets the burglar in itself Security Pure irony: a popular security plugin on 4 million sites had a flaw that let you log in as any user, including the administrator. You register as an ordinary user, you walk out as an administrator Security Membership plugins can be a back door. A flaw in Ultimate Member let you become a site administrator right at registration, and it was exploited in the wild. A "free" version of a paid plugin? The most expensive mistake on a site Security Pirated plugins and themes (so-called nulled) tempt with a "free" price. In reality they very often contain hidden malicious code. We explain why it is a trap and how to avoid it.

Login, passwords and access

The most common way in is not a sophisticated flaw but a guessed or stolen password.

Brute-force login attacks, how to defend yourself Security Bots try to guess your panel password non-stop. We explain how a brute-force attack works and five things that close the door on it. The password "Company123!" will not protect your site, do this instead Security The most common way into a site is not a sophisticated attack, but a weak password. Here is how to close that door in a few minutes, a password manager and two-factor login in plain words. A password manager, why it is worth it and how to start Security The same passwords over and over is asking for trouble. A password manager solves the problem once and for all, we explain how it works and why it is safe. How to safely give an agency or freelancer access to your site Security You outsource changes to your site and have to give someone access. We show how to do it safely, so you do not hand over the keys to the whole kingdom. XML-RPC in WordPress, is it worth disabling? Security XML-RPC is an old WordPress mechanism that today serves attackers more often than site owners. We explain in plain words what it is and when it is safe to disable.

WooCommerce stores

E-commerce is a double target: customer data and money. It needs more attention.

A shop is a tempting target, how a payments flaw hands the panel to strangers Security In 2023 a flaw in the WooCommerce Payments plugin let a stranger pose as the shop administrator. With a single request header. WordPress had to force updates. WooCommerce, 8 things that protect your shop and customers Online stores WooCommerce powers millions of shops, and that is exactly why it is a target. Here is a concrete list of protections that make a difference, without technical jargon.

When a break-in has already happened

How to recognise an infection and what to do first, step by step.

How to tell your WordPress site has a virus Security Strange redirects, Google warnings, spam in the search results. Five signs that someone unauthorised has taken over your site, and what to do then. Site hacked? The first hour decides everything Security You already know something is wrong, redirects, a Google warning, strange files. What now? Here is a plan for the first hour: what to do in order and what not to do under any circumstances. You cleaned the site and the virus came back? Backdoors are to blame Security The site gets cleaned, and a few days later the infection returns. It is not bad luck or a "strong virus", it is a backdoor nobody removed. We explain how to break the cycle. Your site redirects to foreign ads? That is a sign of a break-in Security You open your own site and it suddenly throws you onto a shady ad or someone else's service. It is a classic symptom of infection, we explain what is happening. Google flagged your site as dangerous, what to do Security The red "This site may be dangerous" screen scares off customers and cuts traffic. We explain where it comes from and how to get off the blacklist.

Protective layer and hygiene

Simple habits that genuinely raise security and limit the impact of any attack.

Security headers (HSTS, CSP) in plain words Security Security headers are quiet instructions your server sends to the browser. Set well, they protect visitors without changing how the site looks. Afraid to click "update"? Here is how to do it without breaking the site Care and backups Updates are essential for security, but sometimes something stops working afterwards. So many people avoid them, and that is worse. Here is how to update safely. A website backup, the insurance everyone forgets about Care and backups A backup is boring until it is the one thing that saves your business. Why it is worth having a backup and how often to make one. The 3-2-1 rule for backups, simple and effective Care and backups A backup only makes sense if it survives the disaster that destroyed the original. The 3-2-1 rule is a proven way to make sure it does.

Frequently asked questions

Is WordPress safe?

Yes, the WordPress core is solid and quickly patched. The vast majority of break-ins result from outdated plugins and themes, weak passwords or pirated add-ons, not a hole in the system itself.

What most often leads to a break-in?

Outdated plugins and themes, reused or weak passwords, pirated ("nulled") add-ons, and the lack of a backup that would let you quickly return to a clean state.

How fast do you need to update after a flaw is found?

In hours, not days. As soon as a flaw becomes public, bots start mass-scanning the internet for unpatched sites; the first attacks often begin the same day.

What should you do when a site is already hacked?

Do not delete everything blindly. Make a copy of the current state, change passwords, find and close the door the intruders came through, and only then clean up. Otherwise the infection comes back.

Free security audit

Prefer someone to keep an eye on this for you?

Send us your website address; we will check it for threats and performance and prepare a free care quote.

Request a free audit →