WordPress itself is secure. Almost every compromise we see comes from weak passwords or outdated plugins.
The essentials
- Keep everything updated — core, themes and plugins. Outdated plugins are the number one entry point.
- Delete what you do not use. An inactive plugin is still code sitting on your server.
- Use strong, unique passwords for the WordPress admin, cPanel and your database. Never reuse them.
- Never use the username "admin". Create a new administrator with a different name and delete the old one, assigning its posts to the new user.
- Enable two-factor authentication on admin accounts with a plugin.
Harden the install
- Limit login attempts to stop brute-force scripts
- Disable file editing by adding
define('DISALLOW_FILE_EDIT', true);towp-config.php - Only install themes and plugins from wordpress.org or a reputable vendor — "nulled" premium plugins very often contain backdoors
- Give each person the lowest role that lets them do their job
- Make sure the whole site is served over HTTPS
Correct file permissions
Folders 755, files 644, and wp-config.php 640 or 600. Nothing should ever be 777.
Back up before you need it
Our daily server backups are your safety net, but keep your own copies too, stored off the hosting account. Test a restore at least once so you know it works.
Signs of a compromise
Unexpected admin users, unfamiliar files in the site root, spam links in your pages, redirects to unknown sites, or a sudden spike in outbound email. If you see any of these, see What to Do If Your Website Is Hacked.
