WordPress Security Basics: 10 Steps That Matter

Is WordPress secure?

WordPress takes security seriously, and the core software is maintained by a large team that releases security fixes quickly. Most problems come from the things around it: out-of-date plugins and themes, weak passwords, and hosting that isn't kept up to date. The ten steps below, based on WordPress's own hardening guide, deal with the large majority of risks.

The 10 steps

1. Keep everything updated

WordPress's hardening guide says you should always keep up to date with the latest version of WordPress, and make sure your plugins are always updated. Turn on auto-updates for plugins you trust and check the rest monthly. See updating plugins safely.

2. Use strong, unique passwords

Use a password manager to create a long, random password for every account: WordPress, your hosting, your email and your domain registrar.

3. Turn on two-step authentication

The hardening guide recommends two-step authentication on top of a strong password. A plugin can add a code from an authenticator app at login.

4. Give people the lowest role they need

Writers can be Authors or Editors, not Administrators. Remove accounts that are no longer needed.

5. Use HTTPS everywhere

HTTPS is part of WordPress.org's hosting requirements. Most hosts provide free SSL certificates. Make sure your WordPress address and site address in Settings › General both start with https://.

6. Turn off the file editor

The dashboard includes editors that can change theme and plugin code. If someone gets into an admin account, they could use them to plant code. Add this line to wp-config.php, above the line that says "That's all, stop editing!":

define( 'DISALLOW_FILE_EDIT', true );

7. Delete what you don't use

The hardening guide advises deleting plugins you aren't using. Do the same with old themes, keeping one default theme as a fallback.

8. Install plugins and themes from trusted sources

Use the WordPress.org directories, reputable developers or sites you trust. Never install "nulled" (pirated) premium themes or plugins: they are a common way malware gets onto sites.

9. Keep backups

The hardening guide says to back up your data regularly, including your database. If the worst happens, a clean backup gets you back online. See how to back up WordPress.

10. Keep your hosting up to date

Run a supported PHP version: WordPress.org recommends PHP 8.3 or greater, and warns that end-of-life versions may expose your site to security vulnerabilities. Choose a host that isolates accounts and patches its servers. See choosing WordPress hosting.

Do you need a security plugin?

A security plugin can add two-step login, limit login attempts and scan for known problems, which is useful. But it isn't a substitute for the basics above: updates, good passwords and backups do most of the work.

What if your site has been hacked?

Change all passwords (WordPress, hosting, database and email), restore a clean backup from before the problem, update everything, and ask your host for help: many will scan and clean accounts. Then work through the steps above to close the gap.

Where to go next

Add security checks to your maintenance checklist, and read how to fix common WordPress errors.