How to Secure WordPress – 12 Steps to Prevent a Hack

WordPress supports 43% of all websites — and is the most common target of attacks. On average, hackers try to break in every day 4,700 times on every public WP installation. Most attacks are automatic and easy to stop if you follow these 12 steps.

In short

• 90% of burglaries uses 3 vectors: weak passwords, outdated plugins, brute force.
• The first 6 steps are the absolute minimum – without them, your website will fall victim sooner or later.
• Wordfence + WPS Hide Login + Limit Login Attempts this is the holy trinity of minimum.
• Backup = your last line of defense. Without it, a hack means your website is lost.

The main vectors of attacks on WP

1. Brute force (attempt to guess the password)

Bot wpisuje setki kombinacji admin/admin123, admin/password, etc., aż trafi. Standard: 1 000 prób na sekundę.

2. Outdated plugins

A plugin released in 2019 has a security flaw. Hackers are scanning to see who else is using it. They can access it without a password.

3. Hacking via a "cheap" plugin

Pirated plugins/themes from null repositories = 90% of malwareAfter installation, the hacker has a backdoor.

4. Administrator Phishing

“Your domain is expiring, log in here” email → fake login page → password theft.

5. SQL injection / XSS

An attack on a poorly written plugin/theme, allowing for SQL or JavaScript injection.

12 steps of security

Step 1: Strong Passwords + 2FA (Most Important)

90% of break-ins are eliminated by this step alone.

• Administrator password: minimum 16 characters, mixed (uppercase, lowercase, numbers, special characters)
• Each administrator has a different, unique password
• Use a password manager: 1Password, Bitwarden, KeePass

2FA (Two-Factor Authentication):

• Plug WP 2FA (free)
• Set up 2FA for ALL users with the "Administrator" and "Editor" roles
• Free app: Google Authenticator, Authy, Microsoft Authenticator

Step 2: Change the login page URL

Domyślny /wp-admin jest dla bota najłatwiejszym celem. Zmiana na /biuro-szefa eliminuje 99% prób brute force.

Plug: WPS Hide Login (free). Setup in 30 seconds.

Step 3: Limit Login Attempts

Even after changing the URL, don't let anyone try 100 passwords.

Plug: Limit Login Attempts Reloaded (free). Default:
– Max 4 attempts
– 20 minute lockout
– After 4 bans: 24-hour ban
– Administrator email notification

Step 4: Update WordPress, Themes, Plugins

Only if:
– Minor update (4.5 → 4.5.1) – immediately
– Major update (5.x → 6.x) – after 1–2 weeks (wait for bug patches)
– Plugins: first for staging, then for production

Auto-update:
– WordPress core: YES
– Plugins: optionally only trusted ones (Yoast, Wordfence) – the rest manually after testing

Step 5: Install WAF (firewall)

Web Application Firewall filters traffic, blocking known attacks (SQLi, XSS, brute force).

Plug: Wordfence (freemium):
– Free: real-time malware scanner, firewall rules with 30-day delay
– Premium ($109/year): real-time threat feed, IP reputation, 2FA

Alternative: iThemes Security (Solid Security), Sucuri.

Cloudflare WAF (paid from $5/mo): global CDN + WAF at the network level, even higher.

Step 6: Regular backups

Golden rule: 3-2-1:
– 3 copies of data
– 2 different media
– 1 off-site (outside the server)

Plugins:
– UpdraftPlus (freemium) — most popular, for GDrive/Dropbox/S3
– BackWPup (freemium) - a strong alternative
– Duplicator — mainly for migrations, but also works for backups

Frequency:
– Website with high volatility (shop, blog) — every day
– Static business card - weekly
– Backup logs = before each update

Step 7: SSL (HTTPS) on all subpages

In 2026, a website without HTTPS is:
– Chrome warning (“Not secure”)
– Google position drop
– Error in tools like Stripe/PayU (require HTTPS)

Free SSL: Let’s Encrypt – most Polish hostings are available in 1 click.

Force HTTPS: w .htaccess:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Step 8: Disable file editing in the panel

WordPress allows you to edit PHP of plugins/themes from the dashboard by default. Any burglar will take advantage of this.

W wp-config.php dodaj:

define('DISALLOW_FILE_EDIT', true);

Step 9: Hide WordPress Version

Jeśli ujawniasz „WordPress 6.5.2”, haker wie, jakie luki w niej są. Domyślnie WP wstawia tę informację w <head> i readme.html.

Way: plug WP Hide & Security Enhancer lub kod w functions.php:

remove_action('wp_head', 'wp_generator');

I usuń readme.html z root folderu witryny.

Step 10: Secure wp-config.php

wp-config.php zawiera dane dostępowe do bazy. Zabezpiecz:

• Move file one level above the public folder (if hosting allows)
• Chmod 440 (only owner and group read)
• Update secret keys once a year (secret-key generator)

Step 11: Disable XML-RPC (if not needed)

XML-RPC is an old remote publishing protocol. Attackers use it for brute force.

If you are not using Jetpack or the WordPress mobile app, please disable:

add_filter('xmlrpc_enabled', '__return_false');

Albo .htaccess:

<Files xmlrpc.php>
  Order Deny,Allow
  Deny from all
</Files>

Step 12: Monitoring and Alerts

Even after all these steps, you may not notice the hack right away. Monitoring detects quickly.

Wordfence Free sends email alerts when:
– Someone is logging in as administrator
– A new plugin is coming
– Core files are modified
– Brute force attempts are coming

Sucuri SiteCheck (free external test): sitecheck.sucuri.net — check once a month.

The most common mistakes

❌ Login "admin"

The first thing the bot tries is always the username. other than "admin", "administrator", company name.

❌ Pirated plugins/themes

"Free Yoast SEO Premium" from an unofficial source = malware. A direct path to losing your website.

❌ Backup only on the server

If the server goes down / hackers encrypt the disk - your backup is gone too. Off-site backup is mandatory.

❌ Everyone has the "Administrator" role

The client asks, "Give me full access." Give me a role Editor instead. The administrator installs plugins, edits the theme - this is an additional risk.

❌ Skipping updates "because they work"

Old plugin "working" for 3 years = 99% sure it has a known vulnerability. Update or replace with a maintained one.

What to do if WordPress is hacked

Full guide: WordPress Hacked - What Now?.

Abbreviation:
1. Disconnect the website (enable maintenance/hosting mode → pause)
2. Change all passwords (WP, hosting, FTP, database)
3. Scan for malware (Wordfence, Sucuri, MalCare)
4. Restore a backup from before the hack
5. Update everything, change secret keys
6. Strengthen security (12 steps above)

What's next

This week:

1. Strengthen admin password + enable 2FA
2. Install Wordfence
3. Change Login URL (WPS Hide Login)
4. Enable Limit Login Attempts
5. Check if backups are going anywhere outside the server

In our web administration We implement these 12 steps as standard, plus monitoring and monthly security reports. Packages start at PLN 299/month.