Quick answer
Most WordPress hacks exploit a short list of avoidable weaknesses. Here's a practical, plain-language checklist to close them before an attacker finds them.
Key takeaways
- Keep core, themes, and plugins updated — outdated software is the #1 way in.
- Use strong, unique passwords with two-factor login, and limit login attempts.
- Keep working, off-site backups and never use nulled themes or plugins.
- Add a firewall and monitoring so problems get caught early.
Most WordPress sites don't get hacked by some sophisticated, targeted attack. They get hacked through a short list of avoidable weaknesses — an outdated plugin, a weak password, no backups. Close those, and you've handled the overwhelming majority of the risk. Here's the checklist.
1. Keep everything updated
Core, themes, and plugins. Outdated software with known vulnerabilities is the single most common way in. If a plugin is abandoned and no longer updated, replace it — an unmaintained plugin is a liability waiting to be exploited.
2. Remove what you don't use
Every installed plugin and theme is attack surface, even when deactivated. Delete the ones you're not using. Fewer moving parts means fewer doors.
3. Use strong, unique passwords — and 2FA
Weak or reused admin passwords are a gift to attackers running automated login attempts. Use strong, unique passwords for WordPress, hosting, and database, and turn on two-factor authentication for admin accounts.
4. Limit login attempts
Brute-force attacks hammer your login page with guesses. Limiting failed attempts and adding basic login protection stops most of them cold.
5. Audit your users
Only give admin access to people who genuinely need it, and remove accounts that are no longer used. Every admin account is a potential entry point.
6. Install a firewall
A web application firewall filters malicious traffic before it reaches your site. It's one of the highest-value layers you can add, catching common attacks automatically.
7. Back up — and test the backup
Automated, off-site backups mean a compromise or a mistake is a recovery, not a catastrophe. A backup you've never tested restoring isn't really a backup — check that it works.
8. Never use nulled themes or plugins
Pirated “nulled” themes and plugins are one of the most reliable ways to get malware onto your site — the cracked software often has it bundled in. The cost saved is never worth it.
9. Use HTTPS everywhere
An SSL certificate encrypts traffic between your visitors and your site. It's standard, usually free, and expected by both browsers and search engines.
10. Monitor for changes
Scheduled malware scanning and file-change monitoring catch problems early — while they're small — instead of when a customer or Google tells you.
Start where the risk is highest
If you do nothing else today: update everything, set strong passwords with 2FA, and confirm you have working backups. Those three close most of the risk. If you'd like a second pair of eyes on where your site actually stands, a free security audit is a low-stakes way to find out.
Free security check
Worried your site is infected?
Get a free security assessment — I'll tell you if your WordPress site is compromised and exactly what it needs. No obligation.
Follow-up questions
People also ask
Because removing what you can see doesn't close the door it came through. A hidden backdoor or an unpatched vulnerability will let an attacker back in even after the obvious infection is gone.
Keep reading
How to Recover Your Google Rankings After a Hack
A hack can tank your search rankings. Here's how to recover them once the site is clean.
WordPress Security for Small Businesses: A Practical Guide
You don't need an IT team to secure a small-business WordPress site. Here's a practical, no-jargon plan that covers the essentials.
How to Secure a WooCommerce Store
A WooCommerce store handles money and customer data, which makes it a target. Here's how to secure it without hurting sales.