WordPress security hardening: stop hacks before they start

How do WordPress sites actually get hacked?

Nearly all WordPress hacks come from five vectors: outdated plugins/themes with known vulnerabilities, weak or reused admin passwords, brute-forced logins, nulled (pirated) themes and plugins carrying malware, and compromised hosting neighbors on cheap shared servers. Targeted zero-day attacks are rare — bots exploiting known weaknesses are the norm.

Forget Hollywood hacking. Real WordPress compromises are industrial: bots scan millions of sites for known plugin vulnerabilities within hours of disclosure, try common passwords against wp-login.php around the clock, and exploit whatever they find automatically. Your site isn't targeted — it's *scanned*.

The five vectors, in rough order of prevalence:

• Outdated plugins/themes (most common). A vulnerability is disclosed, a patch is released, and bots immediately hunt sites that haven't updated. The window between disclosure and mass exploitation is now hours, not weeks.
• Weak credentials. 'admin' + weak password remains shockingly effective. Credential-stuffing with leaked email/password pairs works too.
• Brute-force logins. Unlimited login attempts let bots try thousands of passwords. Default login URLs and usernames make it easier.
• Nulled themes/plugins. Pirated premium plugins routinely ship with backdoors — the 'free' plugin is the attack.
• Bad hosting. On overcrowded shared servers, one compromised neighbor can reach your files through poor isolation.

Understanding this changes your strategy: you don't need exotic defenses, you need to close the known doors — updates, strong unique credentials, login protection, clean software sources and decent hosting. That blocks the overwhelming majority of automated attacks.

Already hacked? Skip to the recovery section at the end — then come back and harden so it doesn't repeat. Repeat infections happen because the *entry point* was never closed.

What is the WordPress hardening checklist, in order?

Harden in this order: update everything, enforce strong unique passwords with 2FA, limit login attempts and move/hide the login page, install a security plugin with a firewall, set correct file permissions, disable file editing and XML-RPC, and verify automated off-site backups. Each step closes a specific attack vector.

1. Update everything — now and always. Core, themes, plugins: enable auto-updates for minor core releases and trusted plugins; update majors promptly after a backup. Delete inactive themes and plugins entirely — disabled code is still exploitable code. This single habit prevents the most common hacks.

2. Lock down credentials. Every admin user gets a unique 16+ character generated password (use the password generator) and 2FA via an authenticator app. Delete the 'admin' username if it exists, enforce strong passwords for all users, and limit admin accounts to people who truly need them — editors don't need administrator roles.

3. Protect the login. Limit login attempts (lockout after 5 failures), add CAPTCHA to the login form, and consider changing the login URL or adding HTTP-level protection. These don't stop targeted attacks, but they defeat the brute-force bots hammering every WordPress site on the internet.

4. Add a firewall. A security plugin with a web application firewall (Wordfence, Sucuri, or Cloudflare's WAF in front) blocks malicious requests before WordPress processes them — SQL injection probes, vulnerability scans, bot floods. The free tiers cover the essentials.

5. Fix file permissions and configuration. Directories 755, files 644, wp-config.php 600 or 640; disable file editing in the dashboard (DISALLOW_FILE_EDIT) so a compromised admin account can't inject code; disable XML-RPC if you don't use it (most sites don't); move wp-config.php one level above the web root where possible.

6. Verify backups. Hardening reduces risk; backups guarantee recovery. Confirm automated daily backups stored *off-site* (not on the same server), and test a restore quarterly — an untested backup is a hope, not a plan. See the backup guide for the full setup.

Which security plugins are worth installing?

One reputable security plugin with a firewall and malware scanner (Wordfence or Sucuri are the established choices) plus Cloudflare in front is the proven combination. Never stack multiple security plugins — they conflict and slow the site. The plugin enforces policy; your habits (updates, passwords, backups) do the real protecting.

Wordfence (free tier is genuinely capable): endpoint firewall, malware scanner, login protection, live traffic view showing attacks in real time. The firewall learns your site and blocks exploit patterns before they reach WordPress. Excellent for most sites.

Sucuri (free plugin + optional paid firewall): strong scanner and hardening checklists; the paid cloud firewall filters traffic before it reaches your server at all, which also helps performance. Good for sites under heavy attack.

Cloudflare (free): not a plugin but essential — DNS-level firewall, bot management, rate limiting and DDoS protection in front of your site. Pair it with one of the above, not instead of basic hygiene.

What the plugin *can't* do: update your plugins for you (well, it can nudge), choose your passwords, remove nulled software, or fix bad hosting. Treat the plugin as enforcement for your policies, not a substitute for them. And after installing, run its scanner immediately — you want to know *now* if something is already wrong, not after hardening locks the doors with the intruder inside.

Verify your SSL is properly configured while you're at it — the SSL checker confirms your certificate chain, and mixed-content warnings (HTTPS page loading HTTP resources) are both a security and trust issue.

What are the most dangerous WordPress security mistakes?

The most dangerous mistakes: running nulled/pirated themes and plugins, using 'admin' with a weak password, never updating, no backups, giving administrator roles to everyone, and installing 'security' plugins from unknown developers. Each one is an open door; together they're an invitation.

Nulled software. The number-one self-inflicted wound. Pirated 'GPL' downloads of premium plugins are the classic malware delivery vehicle — backdoors, SEO spam injectors, redirect scripts. If you can't afford the premium plugin, use a free alternative from wordpress.org. There is no safe source of nulled plugins.

'admin' + weak password. Bots try this combination first, millions of times a day, against every WordPress site. It's the digital equivalent of leaving your key under the mat with a sign. Unique admin username, generated password, 2FA — non-negotiable.

Set-and-forget updates. The site worked fine for two years, so nobody logged in — meanwhile three critical vulnerabilities were disclosed and patched, and bots found the unpatched site. Enable auto-updates for minors and schedule a monthly 15-minute maintenance check.

No tested backups. Discovered during every disaster: backups that were never configured, stored on the same hacked server, or three years old. A backup you haven't test-restored is a rumor.

Everyone's an administrator. The intern, the SEO freelancer, the developer from 2019 — all admins, all attack surface. Principle of least privilege: give each person the lowest role that lets them work, and remove access when the work ends.

Security theater. Hiding the WordPress version, renaming wp-admin, installing obscure 'hardening' plugins from unknown authors — these inconvenience you more than attackers, who fingerprint sites a dozen other ways. Do the fundamentals instead.

How do you know if your WordPress site is already hacked?

Warning signs: Google warnings ('This site may be hacked'), unexpected redirects (especially to spam/pharmacy sites), new admin users you didn't create, files modified recently that you didn't touch, sudden traffic drops, spam pages indexed in Google (check site:yourdomain.com), and hosting warnings about outgoing spam or resource abuse.

Hacks often run quietly for weeks — modern malware wants your server's resources and SEO authority, not a defaced homepage. Check proactively:

• Google it: search site:yourdomain.com — spam pages (pharmacy, casino, essays) indexed under your domain are the classic sign.
• Check users: any administrator you don't recognize is an emergency.
• Check files: recently modified core files you didn't touch, unknown files in uploads folders (.php files in /uploads/ are always malicious).
• Check redirects: visit your site as a logged-out mobile user — some malware only redirects non-logged-in mobile traffic to hide from owners.
• Check Search Console: Google flags hacked sites in Security Issues; hosting panels flag spam/phishing.
• Check performance: sudden slowness or resource warnings can mean crypto-miners or spam bots running on your server.

If you find evidence, don't just delete the suspicious file — modern malware plants multiple backdoors and scheduled reinfection. The first hour matters: take the site offline or into maintenance mode, change all passwords (hosting, WordPress, database, FTP) from a clean device, and restore from a known-clean backup if you have one. Full cleanup procedure is in the malware removal guide.

After any incident, assume credentials are burned: hosting panel, FTP/SFTP, database, WordPress admins, and any API keys stored on the server. Rotate all of them — reinfection via stolen FTP credentials is depressingly common.

What should you do in the first hour after a hack?

Put the site in maintenance mode, change every password from a clean device (hosting, WordPress, FTP, database), scan with a security plugin to assess scope, restore from a known-clean backup if available, and identify the entry point (outdated plugin? weak password?) before bringing the site back. Never just delete one file and hope.

Panic deletes evidence; procedure saves the site:

• Minute 0–10: Contain. Enable maintenance mode. If malware is redirecting visitors or sending spam, ask your host to suspend the site temporarily — a hacked site actively harms visitors and your reputation.
• Minute 10–20: Lock credentials. From a *clean* device (not the possibly-compromised one you normally use), change hosting panel, FTP/SFTP, database and all WordPress admin passwords. Enable 2FA everywhere.
• Minute 20–40: Assess. Run Wordfence/Sucuri scans; list recently modified files; check for rogue admin users and unknown cron jobs. Screenshot everything — you'll need it.
• Minute 40–60: Recover. Restore the most recent *clean* backup (verify the backup predates the infection — check file modification dates). If no clean backup exists, professional malware removal is the safe path; DIY cleanup that misses one backdoor reinfects within days.

Then the critical step most people skip: find the entry point. Which plugin was outdated? Which password was weak? Was it nulled software? If you restore without closing the hole, you're scheduling the next hack. The hardening checklist at the top of this guide is your post-recovery program.

Finally, check the blast radius: Google Search Console security issues, blacklists (Sucuri SiteCheck, Google Safe Browsing), and whether spam pages were indexed (request removal after cleanup). A cleaned site with lingering blacklist entries still loses traffic — verify delisting explicitly.

Frequently asked questions