Most WordPress hacks come through outdated plugins and weak logins, not WordPress itself. This checklist puts the fixes in order of impact: updates, fewer plugins, stronger logins with two-factor, the right user roles, backups, a firewall, HTTPS and a few lines of hardening.
Keep everything updated, remove what you don’t use, protect logins with two-factor, and keep off-site backups. Those four steps close most of the doors attackers use. Patchstack counted 11,334 new vulnerabilities in the WordPress ecosystem in 2025: 91% were in plugins and only six in WordPress core. The full checklist:
Most attacks use flaws that already have a fix. WordPress installs minor releases by itself. For plugins and themes you trust, turn on automatic updates from the Plugins and Themes screens. Test big updates, such as a new major WordPress version or a WooCommerce release, on a staging copy first.
Every plugin is code someone can attack. Remove plugins and themes you don’t use: a deactivated plugin still sits on the server. Before you install a new one, check that it was updated recently, has a solid install base and answers support questions.
WordPress doesn’t build two-factor login into core, so add it with a plugin, for administrators at least.
Use a unique, long password for every account, kept in a password manager.
An account can only do the damage its role allows. Give writers the Editor or Author role, keep Administrator for the few people who change plugins and settings, and remove accounts when people leave. WordPress’s guide to roles and capabilities explains each role. Give tools that connect to the site an application password, which you can revoke on its own. Hiring help? Our guide to hiring a WordPress developer covers giving access safely.
A backup you haven’t restored is a guess. Keep automatic daily backups somewhere other than the server, from your host or a plugin such as UpdraftPlus (4 million+ installs). Keep a few weeks of copies, and restore one to a staging site now and then to prove it works.
A firewall blocks known attacks before they reach WordPress. Many hosts and CDNs run one in front of the site. Inside WordPress, Wordfence adds a firewall and a malware scanner, and Sucuri Security (600,000+ installs) adds remote malware scanning, file-change monitoring and an activity log. Run one scanner, not several, and act on what it reports.
Serve every page over HTTPS, which most hosts now provide with a free certificate. Then add security headers: Strict-Transport-Security keeps browsers on HTTPS, X-Content-Type-Options stops file-type guessing, a Referrer-Policy limits what other sites see, and a frame rule stops other sites embedding yours. Check the result with a header scanner after the change.
By default an administrator can edit theme and plugin code from the dashboard. If an admin account is ever taken over, that editor hands the attacker the site. Add this line to wp-config.php:
define( 'DISALLOW_FILE_EDIT', true );WordPress’s hardening guide notes that it won’t stop an attacker who can upload files, but it closes one easy route. The same guide recommends file permissions of 644 for files and 755 for folders.
An unsupported PHP version stops getting security fixes. WordPress recommends PHP 8.3 or newer, and MySQL 8.0 or MariaDB 10.11 or newer. Ask your host which versions you run and how they patch the server.
Agents and integrations need access too, and they should never use your login. Connect each one as its own WordPress user with the lowest role that does the job, through OAuth or an application password, and keep a log of what it changes. Our guides on connecting ChatGPT and connecting Claude show how.
Security is mostly upkeep: updating, removing and checking, every week, on every site. WPOS puts an agent inside wp-admin on the sites you already run, on any host, so a routine check becomes one request:
“List every inactive plugin and theme on this site, and every user with the Administrator role, so I can decide what to remove.”
WPOS is our product, so weigh this section accordingly; you can try it free for 30 days with 5,000 credits, a live site plus a staging sandbox, and no card.
WordPress core is well maintained: Patchstack found only six of 2025's 11,334 new WordPress vulnerabilities in core. Most risk comes from outdated plugins and themes, weak passwords and missing backups.
No. Add it with a plugin, such as Two Factor from WordPress.org or a security suite, at least for administrator accounts.
Not always. If your host runs a firewall, blocks login attacks and keeps backups, you may only need a plugin for two-factor login. Avoid stacking several security plugins that do the same job.
Common signs: administrator accounts you don't recognize, redirects to other sites, spam pages showing up in Google, browser warnings, or a notice from your host.
It cuts down bot traffic but isn't real protection. Two-factor login and limits on login attempts do far more.
Keeping plugins, themes and WordPress updated, and deleting the ones you don't use.
WPOS puts an AI agent inside wp-admin on the sites you already run, on any host, and it checks its own work. Free for 30 days: 5,000 credits, a live site plus a sandbox, no card.
Start free