WordPress is targeted because it's popular — automated bots probe every site, every day. The good news: sites that follow this basic checklist are harder targets than 99% of what bots are looking for, so they move on.
The security checklist
- Strong, unique admin password — generated, long, stored in a password manager; never reused from another site. And never an account named "admin".
- Update everything, always — core, plugins, themes. Enable auto-updates (see the updates guide). This one habit prevents most hacks.
- Delete unused plugins and themes — every installed item is a possible door, even deactivated ones.
- Limit the users: Users → All Users — remove accounts you don't recognize or no longer need; give people the lowest role they actually need (Editor/Author instead of Administrator).
- Add login protection: install a well-known security plugin (e.g. Wordfence) and enable its firewall and login-attempt limits; enable two-factor authentication (2FA) for admin accounts if your plugin offers it.
- Only install from trusted sources — wordpress.org or the original seller. Nulled/pirated themes and plugins usually contain the malware themselves.
- Backups running (see the UpdraftPlus guide) — security includes being able to recover.
- SSL on (https) so logins aren't sent in the open — your free Let's Encrypt certificate covers this (SSL category).
✅ Result: Your site now has the protections that stop the automated attacks responsible for almost all WordPress compromises: patched software, a hard login door, few entry points, and a working way back.
Five-minute weekly habit: log in, apply pending updates, glance at the Users list, confirm the last backup ran. Sites get hacked through neglect, rarely through genius.
⚠ Common mistakes & fixes
- Sharing one admin login among the whole team: when someone leaves, you can't lock them out without locking everyone out. One account per person.
- Installing a security plugin and never opening it: enable the firewall and review its alerts — a plugin sitting at defaults with alerts ignored is decoration.
- "My site is too small to hack": bots don't know or care — they scan everything, because small sites are used to send spam and attack others.
Related articles
- How to Make Your Accounts Secure (Strong Passwords, 2FA)
- What to Do If Your Website Gets Hacked
- How to Update WordPress, Themes & Plugins Safely