WordPress powers over 40% of the web, making it the most targeted CMS by a significant margin. Most WordPress attacks aren't sophisticated — they exploit known vulnerabilities in outdated plugins, weak passwords, and basic misconfigurations.
1. Keep WordPress, themes, and plugins updated
The single most effective measure. Most compromises exploit vulnerabilities in outdated plugins or themes for which patches have been available for weeks or months. Enable automatic updates for WordPress core. Review and apply plugin and theme updates at least weekly.
2. Remove plugins and themes you don't use
Inactive plugins are still attack surface. If you're not using it, delete it — not just deactivate it.
3. Use strong, unique passwords and limit login attempts
Your admin password should be long, random, and unique. Install a plugin that limits login attempts (Limit Login Attempts Reloaded, or Wordfence). This stops brute-force attacks from cycling through thousands of passwords.
4. Change the default admin username
The username admin is what every brute-force script tries first. Create a new administrator account with a different username and delete the old one.
5. Enable two-factor authentication
Even with a strong password, 2FA adds a second layer. Several free plugins (Wordfence, WP 2FA) add this to your login page.
6. Use HTTPS
Your site should be served over HTTPS with a valid SSL certificate. If you're still on HTTP, visitor login credentials are transmitted in plaintext.
7. Hide your WordPress version
WordPress adds a generator meta tag to every page revealing your version. Remove it — it helps attackers target known vulnerabilities for your exact version. Security plugins handle this automatically.
8. Restrict access to wp-admin
If your admin panel only needs to be accessible from certain IP addresses, restrict access at the server level.
9. Set up regular backups stored offsite
Keep automated backups of your site and database stored somewhere other than the same server. Test restoring from backup occasionally — a backup you've never tested is a backup you can't trust.
10. Run a security scan
threatprobe.app's free scan checks your WordPress installation for version disclosure and known outdated components. The Basic report adds plugin and theme enumeration. Full adds an aggressive audit covering vulnerable plugins, themes, and exposed user accounts.