WordPress security guide: the measures that matter and what to do if you have been hacked

Where WordPress security problems actually come from

WordPress powers a very large share of the websites that exist, which makes it an attractive target: an attacker who finds a flaw in a popular plugin can try it automatically on thousands of sites. Most of the time nobody is targeting you personally. Automated scripts are simply hunting for sites with the same known vulnerability.

The WordPress core is generally well maintained. The weak points are usually elsewhere:

• plugins and themes that are out of date or abandoned by their authors;
• weak passwords, reused or sent by email;
• forgotten user accounts that still have administrator rights;
• “nulled” plugins and themes (pirated premium versions), which often contain hidden code;
• carelessly configured servers, with overly broad permissions or unsupported PHP versions.

The good news is that these causes are within your control. You do not need a large budget, only a checklist and some discipline. Security also ties in with your choice of hosting, which we cover in the guide to choosing web hosting.

Updates: the cheapest protection there is

Every public security update also announces, implicitly, that a vulnerability existed. From the moment of publication, attackers can exploit it on sites that have not updated. A delay of a few weeks can be enough for a site to be compromised.

In practice:

• Update the WordPress core, themes and plugins regularly; once a week is a good rhythm for most sites.
• Before major updates, take a backup and test, ideally on a staging copy, especially for shops.
• Delete plugins and themes you do not use. A deactivated theme still sits on the server and can be exploited.
• Check that plugins are still maintained. If the last update was years ago, look for an alternative.
• Run a version of PHP that is still supported by the PHP project; your host usually shows the option in the control panel.

Automatic updates for trusted plugins and for minor core releases can reduce risk, provided you have backups and monitoring in place, so you notice if an update breaks something.

Passwords, accounts and two-factor authentication

Brute-force attacks try thousands of username and password combinations. Credential stuffing, which uses passwords leaked from other services, often succeeds when you reuse the same password on several services.

Minimum rules

• A unique, long password generated by a password manager for every account: WordPress, hosting, FTP, database, email.
• Do not use “admin” as a username, and do not leave author names exposed in URLs.
• Enable two-factor authentication (2FA) for all administrators and editors, using an authenticator app rather than SMS where possible.
• Give each user only the role they need: a copywriter does not have to be an administrator.
• Remove the accounts of former colleagues and agencies you no longer work with straight away.
• Limit failed login attempts, through a plugin or a firewall.

If several people need access, use a password manager with sharing, not spreadsheets or WhatsApp messages.

Backups that genuinely save you

A backup is only useful if you can restore it. Many businesses discover in a crisis that the archive is incomplete, out of date or stored on the same infected server.

1. Sensible frequency. A brochure site rarely changes, so a daily or weekly backup is usually enough. A shop with orders needs daily or more frequent database copies.
2. Files and database. Save both; the database holds the content, orders and settings.
3. Off the server. Keep at least one copy somewhere else (a separate cloud storage account), not only in the hosting folder.
4. Several versions. Keep copies from recent days and recent weeks, because an infection can go unnoticed for a while.
5. A restore test. Twice a year, restore a copy to a test environment and check that the site starts.

The classic 3-2-1 rule says: three copies, on two types of media, one of them off-site. For a small company site you can adapt the idea: the host’s backup plus an external one.

Permissions, configuration and firewalls

These are the more technical measures. You do them once and then maintain them.

A WAF can be a service in front of your server, offered by some network providers, or a plugin that runs inside WordPress. The first filters traffic before it touches the server; the second uses local resources. You do not need both, but you do need at least one, plus a sensible configuration. For the visible side of trust (a valid certificate, well-built forms, safety cues on the page), you can run a quick check with our landing page audit.

How to tell that a site has been compromised

Some attacks are loud (the site displays a foreign message); others are silent and last for months. The signs worth taking seriously:

• visitors are redirected to other sites, especially from mobile or from Google;
• new pages appear that you never created, with text about gambling, medicines or counterfeit goods;
• in Google results, your site’s titles or descriptions show different content;
• new users with an administrator role appear;
• the browser or Google shows a security warning;
• your host sends abuse notices or suspends your account;
• the site suddenly becomes slow or sends spam emails.

Malicious code is often hidden in files with ordinary names, in the database or in the uploads folder. That is why cleaning only the page you can see is not enough.

What to do if you have been hacked: steps in order

1. Stay calm and do not delete everything. Take a copy of the current state (for analysis), then put the site into maintenance mode or temporarily block access.
2. Tell your host. Many providers can help with scans or show you the server logs.
3. Change every password: WordPress, hosting, FTP/SFTP, database, email. Regenerate the security keys in wp-config.php too.
4. Remove unknown users and review existing roles.
5. Replace the core, theme and plugin files with clean versions downloaded from official sources. Never reinstall anything pirated.
6. Look for suspicious files: PHP files in the uploads folder, recent changes to .htaccess, unknown scheduled tasks.
7. Restore a clean backup, if you have one from before the infection, then update everything that was vulnerable straight away.
8. Find the cause. Without it the attack repeats: an old plugin, a stolen password, a forgotten account.
9. Request a review in Google Search Console if the site received security warnings.

If the site holds customers’ personal data (orders, forms), a compromise may count as a personal data breach, and the GDPR sets out notification duties, under certain conditions and within a short deadline, generally 72 hours from becoming aware of it.

The information on legal obligations is general, not legal advice. For a real incident, speak to a lawyer or a data protection officer (DPO). You will find more about personal data on websites in our article on GDPR and cookies.

Common mistakes

• “I have a security plugin, so I am covered.” A plugin helps, but it does not replace updates and good passwords.
• Several security plugins at once. They can block each other and they slow the site down.
• Backups only on the same server. If the server is compromised or suspended, you lose the copies too.
• Pirated themes and plugins. Saving a few tens of euros can cost you a full clean-up.
• Shared accounts. You cannot tell who made a change, and you cannot withdraw one person’s access.
• Ignoring speed. A site loaded with redundant plugins is both slower and more vulnerable; speed and security often improve through the same clean-up effort.

How we approach it

For the sites we look after, we work from a fixed list: verified updates, off-site copies, uptime monitoring, removal of unused plugins and periodic review of accounts. When we take over an existing site, we begin with an inventory: which versions are running, who has access, where the backups are.

We do not promise “total security”, because it does not exist; we promise reduced risk and a quick response. If you would like someone to handle these checks continuously, see our WordPress maintenance service. And if your site has come to hold customer data and internal processes, it is worth discussing a custom system, with roles and an action log.

In short

• Breaches most often come from old plugins, weak passwords and forgotten accounts.
• Update regularly and delete what you do not use.
• Enable 2FA and use unique passwords in a password manager.
• Keep off-site backups and test the restore.
• Add a firewall and limit permissions.
• If you have been hacked, fix the cause, not just the symptom.