WordPress security
Basic protection measures: updates, strong passwords, plugins, login protection and regular backups.
WordPress is the most popular system and therefore the most common target. Most attacks use known holes in outdated plugins or weak passwords.
- Update core, plugins and themes and enable automatic updates: Updating WordPress.
- Use strong passwords and do not use the username
admin. Give every user their own account with the lowest role needed. - Limit login attempts. Install a reliable security or login limiting plugin and enable 2FA for administrators.
- Remove the unused. Delete (not just deactivate) inactive plugins and themes.
- Download plugins only from official sources (wordpress.org or directly from the author). "Nulled" premium themes often contain malicious code.
- Run a security check in WP Toolkit (Security) and apply the recommended fixes.
- Make regular backups and occasionally check that they can be restored.
Extra settings#
- Enable HTTPS: Forcing HTTPS.
- In
wp-config.phpdisable file editing from the admin area:
php
define('DISALLOW_FILE_EDIT', true);- Watch file permissions (usually folders 755, files 644): File permissions.
If you suspect the site is compromised, read Hacked website right away.
Was this article helpful?
Thanks for your feedback! Need help? Open a ticket.
Related articles
Account security and passwordsPractical measures to protect cPanel, email and your site: strong passwords, updates and safe habits.Two-factor authentication (2FA)Enable 2FA in cPanel with an authenticator app and protect your login even if the password leaks.Hacked website: what to doSteps to stop an attack, clean malicious code and prevent it from happening again.Updating WordPressSafely updating core, plugins and themes, with a backup and automatic updates enabled.