The most important thing I can tell you about how to secure your WordPress website installations: the majority of compromised WordPress sites were not hacked through sophisticated zero-day exploits. They were compromised through outdated plugins, weak passwords, no two-factor authentication, or a login page exposed to unlimited brute-force attempts. The attacks that breach most WordPress sites are automated, opportunistic, and looking for the simplest point of entry. This is genuinely good news, because it means that a disciplined but not technically complex approach to secure WordPress website deployments closes the door on the vast majority of attacks before they ever reach your site. I have set up WordPress security configurations across many different site types over the years, and the sites that stay clean are not the ones with the most expensive security plugins — they are the ones with the most consistently applied fundamentals. This guide covers those fundamentals in the order of impact they provide for how to secure WordPress website deployments of any size. For the bigger picture, our Complete Guide to WordPress How pulls everything together.
Keep WordPress Updated — The Foundation of how to Secure your WordPress Website
Outdated WordPress core, plugins, and themes are the most common entry point for attacks on WordPress sites. Every security vulnerability that is discovered in WordPress or in a popular plugin is publicly disclosed when the patch is released — which means every unpatched site becomes a target the moment the vulnerability is announced. A site running WordPress 6.3 after WordPress 6.4 has been released with a security fix is not just outdated; it is a known vulnerable target for automated scanners that probe for that exact vulnerability. To secure your WordPress website installations effectively, the update schedule is not optional.
Enable automatic minor updates for WordPress core — these are the security patches and bug fixes that carry the lowest breaking risk and the highest security value. In wp-config.php, define( 'WP_AUTO_UPDATE_CORE', 'minor' ); enables automatic minor updates while leaving major version updates for manual review. For plugins, the WordPress admin allows enabling automatic updates per-plugin — go to Plugins → Installed Plugins and click the “Enable auto-update” link next to each plugin you trust to update automatically. Enabling automatic updates on all actively maintained plugins from the WordPress Plugin Directory is a low-risk, high-value security practice for most sites.
Plugin selection itself matters significantly for how you secure your WordPress website deployments. A plugin that was last updated two years ago and has not been tested with recent WordPress versions carries meaningful security risk — old code against current WordPress and PHP versions is often where vulnerabilities live. When evaluating a plugin for installation, the Active Installations count and the Last Updated date in the WordPress Plugin Directory are the two metrics most directly correlated with security maintenance quality. A plugin with 500,000 active installations and an update from last month has vastly more security scrutiny than one with 500 installations and a three-year-old last update.
Secure Your WordPress Website Login — The Primary Attack Surface
The WordPress login page at /wp-login.php and /wp-admin/ is the primary surface that automated brute-force attacks target. Securing this entry point is the single highest-impact action to secure your WordPress website installations because it blocks the category of attack responsible for the majority of WordPress compromises. A few complementary measures applied together make brute-force attacks practically infeasible.
- Use a strong, unique password for every WordPress admin account. A 16-character random password generated by a password manager is not guessable by any brute-force tool within any practical timeframe. “Admin2024!” is guessable. Use your password manager’s generator exclusively for WordPress admin accounts.
- Enable two-factor authentication on all admin accounts. Even a compromised password cannot be used without the second factor. The miniOrange 2-Factor Authentication plugin or the Two Factor plugin (both free) add TOTP-based 2FA to WordPress login. This single change to secure your WordPress website admin access is the most impactful after strong passwords.
- Install a login protection plugin with rate limiting. Wordfence (free) or Limit Login Attempts Reloaded (free) block an IP address after a configurable number of failed login attempts. Five failed attempts before a 30-minute lockout eliminates the effectiveness of automated brute-force tools that rely on thousands of attempts per minute.
- Change the login URL from the default. The WPS Hide Login plugin changes the login URL from the universally known
/wp-login.phpto a custom path. Automated scanners primarily target the default URL — a custom login URL stops most automated brute-force attempts before they even reach the login form. - Restrict admin access by IP if your IP is static. Limiting
/wp-admin/access to your office or home IP in.htaccessis the most aggressive login security measure available and makes admin access completely inaccessible from any other IP.
| Measure | Difficulty | Impact to Secure your WordPress Website Login |
|---|---|---|
| Strong unique password | Trivial — use a password manager | High — eliminates password guessing |
| Two-factor authentication | Low — plugin install + 5-minute setup | Very high — credential theft becomes insufficient |
| Login rate limiting | Low — plugin install, minimal configuration | High — eliminates brute-force effectiveness |
| Custom login URL | Low — plugin install | Medium — stops automated targeting of default URL |
| IP restriction on admin | Medium — requires static IP and .htaccess edit | Very high — admin inaccessible from all but your IP |
A Web Application Firewall to Secure your WordPress Website Traffic
A Web Application Firewall (WAF) inspects incoming requests before they reach WordPress and blocks requests that match known attack patterns — SQL injection attempts, cross-site scripting (XSS) payloads, local file inclusion probes, and other standard web attack signatures. Adding a WAF to secure your WordPress website deployments provides protection at the network or application layer rather than relying solely on WordPress itself to handle malicious input safely.
Cloudflare’s free plan includes a WAF with a basic rule set and DDoS protection — it operates at the network level before requests ever reach the hosting server, making it one of the most effective and lowest-friction ways to secure WordPress website deployments of any size. The free plan’s WAF rules cover the most common WordPress-targeted attacks, and the Pro plan adds more specific WordPress-targeted rule sets. The Cloudflare WordPress plugin integrates the firewall configuration directly into the WordPress admin, simplifying setup for non-technical users.
Application-level WAFs through security plugins — Wordfence, Sucuri, MalCare — inspect requests after they reach the server but before they are processed by WordPress. These provide more WordPress-specific protection (knowing which URL patterns are attack-indicative in a WordPress context) but require server resources to run, unlike Cloudflare’s network-level approach. For sites on shared hosting where adding Cloudflare is straightforward, the network-level WAF is typically the better choice for how to secure WordPress website traffic. For sites on managed WordPress hosting that already includes server-level security scanning, a Cloudflare-plus-plugin combination provides defense in depth.
File Permissions and Server Configuration for a Secure WordPress Website
Correct file permissions prevent attackers who have gained limited server access from escalating that access by modifying WordPress files. The standard permissions for a secure WordPress website installation: all files at 644, all directories at 755, wp-config.php at 600 or 640, and the wp-content/uploads/ directory at 755. The uploads directory needs to be writable for media uploads, but the files uploaded there should not be executable — adding an .htaccess file inside wp-content/uploads/ containing php_flag engine off prevents PHP execution from that directory, which means malicious PHP files uploaded through a vulnerability cannot be executed.
Two additional .htaccess configurations that meaningfully secure WordPress website deployments: block direct access to wp-config.php (add <files wp-config.php> order allow,deny deny from all </files> to the WordPress root .htaccess) and disable XML-RPC if not in use (<files xmlrpc.php> order deny,allow deny from all </files>). XML-RPC is a legacy WordPress API that is frequently targeted by brute-force attacks and malware distribution — most modern sites using REST API-based communication do not need it and should disable it.
The wp-admin and wp-includes directories should not allow direct PHP file execution via URL — only the specific files that need to be web-accessible should be accessible. Adding Options -Indexes to the WordPress root .htaccess prevents directory listing (returning a 403 for requests to directories without an index file) rather than exposing the full file list to anyone who navigates to a directory URL. Directory listing exposure is a low-level but real information leak that helps attackers identify the plugins installed, their versions, and potentially vulnerable components — a simple .htaccess line to secure WordPress website deployments against this class of reconnaissance.
Database and Backup Security
The WordPress database contains every user account, every post, every order, and every configuration value — it is the most sensitive data on the entire server. Two specific database security measures meaningfully secure WordPress website deployments against database-targeted attacks. First: change the default WordPress database table prefix from wp_ to a custom prefix during installation, or migrate it afterwards using a plugin like Brozzme DB Prefix. SQL injection attacks targeting WordPress often hard-code the wp_ prefix — a non-standard prefix invalidates these attacks without any other change. Second: ensure the WordPress database user has only the permissions WordPress actually needs — SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, and INDEX on the WordPress database only. A database user with all privileges on all databases is a significantly larger attack surface than one scoped to the minimum necessary permissions.
Regular database backups are part of a secure WordPress website strategy because database backups enable recovery from SQL injection attacks that corrupt or delete data, from ransomware that encrypts the database, and from hosting incidents that damage the database. The backup itself should be stored off the server — a backup stored on the same server as the compromised site is worthless if the attack affects the entire hosting account. Configure UpdraftPlus or your hosting provider’s backup system to transfer database backups to Google Drive, Dropbox, or Amazon S3 daily.
Security Monitoring and Malware Scanning
Even with every preventive measure in place, a secure WordPress website strategy requires ongoing monitoring to detect problems that get through. Security is not a one-time configuration — it is a continuous process that includes regular scanning, log review, and notification of unusual activity.
The key monitoring components for a secure WordPress website ongoing strategy:
- Malware scanning: Wordfence (free) includes a malware scanner that compares WordPress core files, themes, and plugins against the known-good versions and flags any modifications. Schedule a weekly scan at minimum — daily if the site handles sensitive user data.
- File change monitoring: Most security plugins include file integrity monitoring that alerts you when any WordPress file is modified. A modified core file that was not the result of an update is a high-confidence indicator of compromise.
- Failed login monitoring: Security plugins log failed login attempts with timestamps and source IPs. A sudden spike in failed attempts from a new IP range indicates an active brute-force campaign targeting the site — the right response is adding the IP range to the block list and verifying that login rate limiting is active.
- Uptime and availability monitoring: Use a service like UptimeRobot (free for basic monitoring) to alert you immediately when the site becomes inaccessible — malware sometimes takes sites offline as a side effect. Knowing within minutes rather than hours reduces the impact.
- WordPress admin email alerts: Configure the active security plugin to send email notifications for new user registrations (particularly admin-role registrations), plugin installations, and settings changes — activities that suggest unauthorized admin access.
Our guide on how to secure the WordPress admin covers the admin-specific security measures in more depth — login URL customisation, admin access restrictions, and user role auditing that complement the broader secure WordPress website strategy in this guide. Our guide on how to backup a WordPress site properly covers the backup configuration that is the recovery layer when the preventive measures in this guide are not sufficient. The WordPress hardening documentation covers the full set of server-level and application-level hardening measures with technical depth beyond what a practical guide like this one can provide. If this sounds familiar, How to Speed up WordPress Website Step by Step is worth a look.
