How to secure a WordPress site: the 10 things that actually matter

WordPress itself is well maintained. The risk comes from the ecosystem around it: thousands of plugins and themes, many abandoned, plus admin accounts protected by reused passwords. Automated bots scan every WordPress site for known weak points daily.

The ten that matter

1. Update WordPress core, themes and plugins. Turn on auto-updates for plugins you trust.
2. Delete plugins and themes you don't use; deactivated code can still be exploited.
3. Only install plugins with recent updates and many active installs.
4. Use a unique, long password for every admin and turn on two-factor authentication.
5. Don't use "admin" as a username, and give each person their own account with the lowest role they need.
6. Limit login attempts with a reputable security plugin or your host's firewall.
7. Keep daily off-site backups and test restoring one.
8. Run a supported PHP version (8.1 or newer).
9. Block PHP execution in /wp-content/uploads/ and disable file editing in the dashboard (DISALLOW_FILE_EDIT).
10. Add security headers and force HTTPS.

Signs your WordPress site is hacked

• Google shows a "This site may be hacked" warning or spammy search results for your domain.
• Visitors are redirected to other sites, especially on mobile.
• New admin users you didn't create.
• Unknown files in wp-content, or strange scheduled tasks.

Run Drofsecurity's website scan to spot outdated JavaScript libraries with known vulnerabilities, missing headers and other exposure from the outside.