How to Secure a WordPress Website: 12 Steps for Beginners (2026)

Learning how to secure a WordPress website does not require coding skills or an expensive toolset. Most WordPress hacks are not clever break-ins aimed at one site. They are automated bots scanning thousands of sites for the same easy openings: an outdated plugin, a weak password, or a backup that was never tested. Close those openings, and your site becomes a much harder target than most of the sites around it.

WordPress itself is well maintained, with a dedicated security team that ships fixes on a regular cycle. The risk usually sits in what gets added on top of it. Security reports from Wordfence and Patchstack have put plugins at over 90% of known WordPress ecosystem vulnerabilities, which is why this guide spends so much time on updates and plugin hygiene. WordPress powers more than 40% of all websites, so bots will probe your site whether it gets ten visitors a month or ten thousand.

Last updated: November 2026

The short version: if you only have one hour today, do these five things in this order: update everything, turn on two-factor authentication for every admin, delete plugins and themes you do not use, set up an off-site backup, and install one reputable security plugin. The rest of this guide explains each step, adds the layers that matter for a business site, and covers what to do if something already looks wrong.

1. Update WordPress, plugins, and themes — and delete what you do not use

Updates are the single highest-impact habit in WordPress security. When a vulnerability becomes public, bots start scanning for sites that still run the old version within hours. That is why an update you keep putting off is not a small chore. It is an open door with a sign on it.

Go to Dashboard > Updates and apply WordPress core updates, then update your plugins and themes. Turn on automatic updates for minor core releases and for plugins you trust. For a store or a site with custom code, test big updates on a staging copy first, because a broken checkout is a problem too — but do not let “I will test it later” turn into months of delay.

Then delete, not just deactivate, anything you do not use. A deactivated plugin still sits on your server, and its old code can still be reached in some setups. The same goes for old themes. Keep the default theme WordPress ships with as a fallback, and remove the rest.

2. Use strong, unique passwords — and retire the “admin” username

Brute-force attacks work by guessing username and password combinations against your login page, over and over, automatically. A short or reused password is the easiest win a bot can get, and credential stuffing — trying passwords leaked from other sites — makes reuse risky even if your password looks strong.

Use a password manager and give every account its own long password. Do not share one admin login across a team. And if your site still has a user called “admin,” create a new administrator account with a different name, log in as the new account, and delete the old “admin” user. It is a small change, but it removes half of what a guessing bot needs.

3. Turn on two-factor authentication for every admin

Two-factor authentication (2FA) adds a second check at login, usually a time-based code from an app on your phone. Even if someone steals or guesses a password, they still cannot log in without that code. For administrators, this is not optional in any serious setup. It is the cheapest protection you will ever add.

Free options include WP 2FA and the two-factor features built into Wordfence. Use an authenticator app rather than SMS codes where you can, since app codes cannot be intercepted the same way a text message can. Turn 2FA on for every administrator and editor account, not just your own, and store backup codes somewhere safe so a lost phone does not lock you out of your own site.

4. Limit login attempts and protect the login page

With 2FA in place, add a second login layer: limit how many times a failed password can be tried before that address is blocked for a while. Most security plugins do this out of the box, and plugins like Limit Login Attempts Reloaded do it on their own. Three to five failed tries before a temporary block is a sensible setting.

You may also see advice to change your login URL from /wp-login.php to something hidden. That can cut down bot noise, but treat it as a bonus, not a fix. Bots find hidden login pages too. Strong passwords, 2FA, and login limits do the real work.

5. Give people the smallest role they actually need

WordPress user roles exist for a reason. A writer who only needs to draft posts should be an Author or Contributor, not an Administrator. A shop manager needs shop access, not the power to install plugins. Every extra administrator is another account that, if compromised, hands over the whole site.

Once a month, check Users in your dashboard. Remove accounts for people who no longer work with you, and downgrade anyone whose role is bigger than their job. On a small business site, there should usually be only one or two administrators.

6. Install one good security plugin and a firewall — not five

A reputable security plugin bundles several layers in one place: a firewall that blocks known attack patterns, malware scanning, login protection, and alerts when files change. The well-established names are Wordfence, Sucuri, and Solid Security. Wordfence’s free version is genuinely useful for a small site, with a firewall, scanner, and login security included.

Pick one and set it up properly. Installing three security plugins at once does not triple your protection. It usually causes conflicts, slows your site, and leaves you unsure which plugin is doing what. A cloud firewall in front of your site, such as Cloudflare’s free plan, adds another layer by filtering bad traffic before it reaches your server at all. If your host already provides a firewall and malware scanning, ask what is covered before you add a plugin that duplicates it.

If you want a second opinion on the basics, Yoast’s guide to WordPress security in a few easy steps covers the same ground in plain language and is a good cross-check.

7. Make sure your whole site runs on HTTPS

HTTPS encrypts the connection between your visitors and your site, so passwords and form details cannot be read in transit. Browsers now mark non-HTTPS pages as “Not Secure,” which also costs you visitor trust. Most good hosts provide a free SSL certificate through Let’s Encrypt.

Check that your WordPress address and site address both start with https://, and that old http:// links redirect to the secure version. If you see mixed-content warnings — some page parts still loading over http:// — your host’s support team or a plugin like Really Simple SSL can usually fix it in minutes.

8. Set up automatic off-site backups — and test one restore

Backups are your safety net when everything else fails. A backup that lives only on the same server as your site is not a real safety net. If the server goes down or gets compromised, the backup can go with it. Store copies somewhere else: your host’s backup system, cloud storage, or a backup plugin that sends files to Google Drive or Dropbox.

UpdraftPlus is a solid free option, and many quality hosts include daily backups in their plans. Whatever you use, set it to run automatically — daily for an active site, at minimum weekly for a quiet one — and back up both files and the database. Then, once a quarter, actually restore a backup to a staging site. An untested backup is a guess, and you do not want to discover it was broken on the day you need it.

9. Choose hosting that takes security seriously

Your host is your first wall. On cheap shared hosting, a compromised site on the same server can sometimes put yours at risk, and slow security patching leaves everyone exposed. When you compare hosts, ask about server-level firewalls, malware scanning, daily off-site backups, account isolation between sites, and which PHP version your site runs on. Outdated PHP is a quiet risk that no plugin can fully cover.

You do not need the most expensive plan. You need a host that patches promptly, answers support tickets, and tells you clearly what security is included, so you are not paying for a plugin that duplicates what you already have.

10. Harden the basics without touching code

A few deeper settings are worth knowing about, even if you let a plugin or your host handle them. Disabling file editing from inside the WordPress dashboard stops an attacker who gets an admin login from editing theme files directly. Protecting wp-config.php — the file that holds your database login — with strict file permissions does the same kind of job at the server level. And if your site does not use the XML-RPC feature (most small sites do not), a security plugin can restrict it, since it is a common brute-force target.

Do not edit wp-config.php or server files by hand unless you are comfortable with them and have a fresh backup. These are one-line jobs for your host’s support team or a developer, and a typo here can take a site down. The point is to know these settings exist and to ask for them, not to become a server administrator overnight.

11. Scan regularly and watch for changes

A security plugin’s scanner checks your files against known good versions and flags anything that changed without explanation. Run a scan weekly, and read the alerts instead of letting them pile up in your inbox. File changes, new administrator accounts, and unexpected redirects are the three warnings to act on the same day you see them.

Also keep an eye on the public side of your site. Search engines sometimes flag infected sites, and visitors may report strange pop-ups or redirects before you notice them yourself. A quick monthly check — load your homepage, check Search Console for security warnings, and confirm your backup ran — catches most problems early.

12. Do not forget forms, comments, and uploads

Contact forms, comment boxes, and file uploads are all ways visitors send data into your site, so they deserve the same care as logins. Use a maintained form plugin, add spam protection such as a CAPTCHA or honeypot field, and never allow uploads from untrusted users unless a plugin specifically manages and scans them. On a business site, comment spam is usually just annoying, but a form that accepts files without checks is a real opening.

What good WordPress security costs

For most small sites, the essentials cost nothing. Updates, 2FA, login limits, Cloudflare’s free plan, Wordfence’s free tier, and UpdraftPlus’s free backups cover the checklist above. Paid plans add faster support, real-time firewall rules, and professional cleanup if you are hacked. As a rough guide, one business checklist puts DIY premium setups at roughly $100 to $300 a year, and professional post-hack cleanup at roughly $200 to $500 one-time. That last number is the point: prevention is cheaper than cleanup, and the free tier already covers nearly everything that matters.

Your monthly WordPress security routine

Security fails when it depends on memory, so put it on a calendar:

• Weekly: apply updates, check that the backup ran, glance at scan results.
• Monthly: review user accounts, delete unused plugins and themes, check your site in Search Console for warnings.
• Quarterly: test-restore a backup to staging, review which plugins have not been updated by their developers in a long time, and rotate passwords for admin accounts.
• Yearly: review your hosting plan, your security plugin’s paid tier, and whether your SSL and domain renewals are on auto-renew.

Mistakes that undo good security

• Stacking security plugins. One well-set-up plugin beats three half-set-up ones.
• Treating a hidden login URL as protection. It reduces noise. It does not replace 2FA.
• Backing up to the same server. If the server fails, so does your only copy.
• Keeping plugins “just in case.” Every installed plugin is an entry point, used or not.
• Sharing one admin login. You cannot tell who did what, and one leaked password compromises everyone.
• Ignoring alerts. A scanner warning you never read is the same as no scanner at all.

Signs your site may already be hacked — and what to do

Watch for sudden redirects to strange sites, new administrator accounts you did not create, spam pages appearing in search results for your domain, pop-ups your theme never had, or a warning from Google or your host. If you see any of these, do not panic and do not keep publishing as normal.

1. Change every password connected to the site: WordPress admins, hosting, FTP, and the database.
2. Take the site offline or into maintenance mode if you can, so visitors are not sent to malicious pages.
3. Run a full scan, and check a free external scanner as a second opinion.
4. Restore a clean backup from before the infection, if you have one. This fixes most cases fast, which is exactly why backups come before cleanup tools.
5. If you have no clean backup, hire a professional cleanup — Sucuri and Wordfence both offer it — rather than spending days learning malware removal yourself. After cleanup, find and close the hole that let the attacker in, or it will happen again.

For a second, detailed walkthrough of these steps, WP Rocket’s guide to securing WordPress covers hosting, logins, and plugins with practical examples.

Frequently asked questions

Is WordPress secure?

Yes, when it is maintained. WordPress core is rarely the problem. Most problems come from outdated plugins, weak passwords, and poor hosting — all things you control.

Do I need a security plugin?

Not strictly, but it makes protection much easier. A plugin bundles a firewall, scanning, and login protection in one place. If your host already covers those at the server level, a lighter setup plus 2FA may be enough.

Can I secure WordPress without plugins?

You can improve security a lot without one: updates, strong passwords, 2FA via your host, HTTPS, and off-site backups all work without a security plugin. A plugin mainly adds scanning and a firewall, which are hard to replace by hand.

How often should I update WordPress?

Check at least once a week, and apply security releases as soon as they appear. Minor core releases and trusted plugins can usually auto-update safely.

Are free security plugins good enough?

For most small sites, yes. Wordfence’s free tier and Cloudflare’s free plan cover the essentials. Paid plans are worth it when you want faster support, real-time rules, or help cleaning up after an attack.

What should I do first if my site is hacked?

Change all passwords, put the site in maintenance mode, scan it, and restore a clean backup from before the infection. If you have no clean backup, hire a professional cleanup and then fix the original weakness.

The bottom line: WordPress security is mostly boring habits done on schedule — updates, strong logins with 2FA, one good security plugin, and backups you have actually tested. Do those four well, and you are already safer than most WordPress sites on the internet.