How to keep your WordPress site secure

Why WordPress sites get targeted

WordPress is used by a huge number of websites, which makes it an attractive target. Most attacks are not personal. Automated tools scan the web for sites with known weaknesses, such as an old plugin or an easily guessed password, and break in wherever they find one. That is good news in a way: if you close the common gaps, you are far less likely to be caught.

1. Keep everything updated

WordPress core, your theme and your plugins all get regular updates, and many of those updates fix security holes. Once a fix is released, details of the weakness often become public, so sites that have not updated become easy targets.

• Check for updates at least weekly, or use hosting that applies them for you.
• Update plugins and themes as well as WordPress itself.
• After updating, check your key pages and forms still work.

2. Remove what you do not use

Every plugin and theme is code that could contain a weakness, even if it is switched off. Deactivated plugins can still be exploited in some cases. Delete plugins you no longer use and remove spare themes, keeping only your active theme and, if you like, one default theme as a fallback.

3. Use strong passwords and two-factor login

Weak or reused passwords are one of the easiest ways in. Give every account a strong, unique password, ideally generated and stored by a password manager. Then add two-factor login, so a stolen password on its own is not enough to get in. Several reputable plugins add two-factor login to WordPress.

4. Limit admin accounts

Not everyone who works on your site needs full administrator access. WordPress has roles such as editor and author for people who only need to write or edit content. Keep the number of administrators as small as possible, remove accounts for people who have left, and avoid a username like "admin".

5. Only install plugins and themes from trusted sources

Stick to the official WordPress plugin and theme directories or well-known developers with a track record. Before installing, check when the plugin was last updated and whether it is actively maintained.

Never use nulled themes or plugins

Nulled themes and plugins are pirated copies of paid products, offered free on unofficial sites. They are a common source of malware: hidden code that can add spam links, redirect your visitors or give attackers a way back in. They also never get proper updates. Saving a little on a licence is not worth the risk.

6. Keep backups off the server

Backups are your recovery plan if something does go wrong. Make sure they are taken regularly and stored away from the server your site runs on, so a hacked or failed server does not take your backups with it. Test a restore now and then, so you know it works before you need it.

7. Use SSL everywhere

An SSL certificate encrypts the connection between your site and its visitors, protecting login details and form submissions. Make sure every page loads over https, including the login page and admin area, not just the home page.

A simple monthly routine

1. Apply any outstanding updates and check the site afterwards.
2. Review your user list and remove anyone who no longer needs access.
3. Delete unused plugins and themes.
4. Confirm recent backups exist and are stored off the server.
5. Look over your site for anything unexpected, such as pages or links you did not add.

If your site is slow as well as worrying you, our guide to speeding up a WordPress site covers the performance side. For a broader overview, see our WordPress security page.

Security built into WP Web Hosting

Every WP Web Hosting plan includes an SSL certificate and regular backups. On WP Managed, at £29.95 a month, we update WordPress, themes and plugins for you and monitor uptime, so the most common gaps are closed without you having to remember. Plans are billed monthly and you can cancel any month. See managed WordPress hosting or compare plans on our pricing page.

Frequently asked