Securing your WordPress site
The essentials that stop most attacks.
- Keep everything updated: WordPress, themes and plugins. See Updating safely.
- Use strong passwords and a unique admin username (not "admin").
- Turn on two-factor authentication for admin accounts with a security plugin.
- Install only reputable plugins and themes from WordPress.org or known developers. Never install "nulled" (pirated) paid themes; they often contain malware.
- Delete what you don't use: inactive plugins and themes can still be exploited.
- Give users the lowest role they need: an author doesn't need to be an administrator.
- Keep regular backups outside the site. See Backing up WordPress.
Web hosting plans include Imunify360, which scans for and blocks malware on the server.
If your site has been hacked, follow our hacked website checklist and open a ticket to the WordPress department.