WordPress security basics: the settings that stop most attacks

By Axyra Nova Editorial · 27 August 2026 · 5 min read · WordPress

The word "hacked" makes WordPress security sound like a battle against skilled attackers. For most small business sites the reality is duller. Automated bots scan the web around the clock, trying common passwords and looking for plugins with known holes. If your site has neither, the bots move on.

This guide covers the WordPress security basics that close those common doors. None of it requires a developer, and most of it takes an afternoon to set up.

Understand where attacks come from

Knowing the usual entry points helps you prioritise:

• Weak or reused passwords on administrator accounts.
• Outdated plugins and themes with publicly known vulnerabilities.
• Abandoned plugins that no longer receive fixes at all.
• Nulled (pirated) themes and plugins, which often ship with malware built in.
• Insecure hosting, such as old PHP versions or shared servers without isolation.

The broader web security community tracks the most common classes of problem in the OWASP Top Ten. You do not need to read it all, but it shows that most breaches come from a short list of predictable weaknesses.

1. Lock down logins

Logins are where bots knock first.

• Use unique, long passwords for every administrator, generated by a password manager.
• Turn on two-factor authentication for every account with editing rights.
• Limit login attempts so bots cannot try thousands of passwords.
• Do not use "admin" as a username. Pick something that is not obvious.
• Remove old accounts. Former staff, past freelancers and test users should not keep access.

The official WordPress hardening guide explains these and other settings in more detail.

2. Keep everything updated

Updates fix known problems. A plugin vulnerability becomes dangerous mainly after it is published, because that is when bots start scanning for it. Sites that update promptly avoid most of the risk.

Follow a routine: check for updates weekly, back up, apply them, test your key pages. Our WordPress maintenance checklist breaks this into a simple schedule.

3. Remove what you do not use

A deactivated plugin is still code sitting on the server. If it contains a flaw, it can still be exploited in some situations. Delete unused plugins and themes, keeping only one default theme as a fallback.

Before installing anything new, check three things on its plugin page: when it was last updated, how many active installations it has, and whether the support forum shows the developer responding. The plugin directory shows all three.

4. Never install pirated software

"Free" copies of premium themes and plugins are one of the most common sources of infected sites. They often contain hidden code that creates secret admin accounts or injects spam links. If a premium plugin is worth using, it is worth paying for, or there is usually a legitimate free alternative.

5. Back up, off the server

A backup stored only on the same hosting account can be lost or infected along with the site. Keep copies in a separate location, and test a restore every few months. Our guide to WordPress backups that actually restore explains a routine that works.

6. Use HTTPS everywhere

Your site should load over HTTPS on every page, with the padlock showing in the browser. Many hosts provide free certificates. If yours does not, the Let's Encrypt getting started guide explains how free certificates work. After switching, make sure plain HTTP addresses redirect to HTTPS.

7. Choose sensible hosting

Good hosting does a lot of security work for you: isolated accounts, up-to-date PHP, malware scanning, firewalls and automatic backups. Cheap hosting that skips these costs more in the long run. Our guide to choosing WordPress hosting lists what to ask.

8. Add a firewall and monitoring

A web application firewall filters out common attack patterns before they reach WordPress. Many hosts include one; security plugins and CDN providers offer them too. Pair it with:

• Uptime monitoring, so you know within minutes if the site goes down.
• File change alerts, so unexpected changes to core files are flagged.
• Login alerts for administrator accounts.

9. Set the right file permissions

Files and folders on the server should only be writable where WordPress genuinely needs to write. Most hosts set sensible defaults. If you are unsure, ask your host to confirm permissions follow WordPress recommendations, and that the wp-config.php file is protected.

10. Have a plan for when something goes wrong

Even well-run sites can be compromised. Decide in advance:

1. Who you will call.
2. Where your latest clean backup is.
3. How you will change every password and key.
4. How you will tell customers if any personal data was affected.

Writing this down now saves panic later.

What a security check looks like

A quick monthly review takes ten minutes:

If you want to learn the fundamentals properly, the free Website security basics course covers them with a quiz after each module.

A worked example

A small online shop received a warning from its host about suspicious login attempts. A quick review showed several weaknesses:

• Two former staff members still had administrator accounts.
• The main admin account used a password that had been reused on other sites.
• Five plugins were months out of date, one of which had a published vulnerability.
• Backups existed only inside the hosting account.

The owner fixed everything in an afternoon: removed old accounts, set unique passwords with two-factor authentication for the remaining admins, updated all plugins after taking a backup, deleted two unused plugins, and set up a weekly backup to separate cloud storage. The suspicious attempts continued for a while, as bots do, but they no longer had an easy way in.

Frequently asked questions

Do I need a security plugin?

Not always. If your host provides a firewall, malware scanning and login protection, a heavy security plugin may duplicate work and slow the site. If your host offers none of these, a reputable security plugin fills the gap.

Is WordPress less secure than other platforms?

WordPress core is maintained carefully. Most problems come from outdated plugins, weak passwords and poor hosting, which are all within your control.

How do I know if my site has been hacked?

Warning signs include unknown admin accounts, unexpected redirects, spam links in your pages, browser warnings and sudden drops in search traffic. If you notice any of these, restore from a clean backup and change every password.

What is the most important step on this list?

Strong passwords with two-factor authentication, combined with prompt updates. Together they stop most automated attacks. If you want help keeping on top of it, see what Axyra Nova tracks for you.