How to Keep Your WordPress Website Secure

At Venbit, a web design and digital marketing studio based in Mill Creek, Washington, we maintain and secure WordPress sites for businesses across the Puget Sound region and for clients around the country. One thing we see consistently, regardless of where a client is located: the sites that get hacked are not hacked because they use WordPress. They are hacked because nobody was watching them.

WordPress powers about 40 percent of the entire web. It is battle-tested, actively patched by a large open-source team, and genuinely solid software. An abandoned plugin from 2021. An admin password that has not changed since the site launched. No backups anywhere. No SSL. These are the gaps attackers scan for, and they find them constantly, automatically, at scale. The good news: closing those gaps is not complicated. Most of what you need to do is a one-afternoon job, and then a 15-minute monthly habit.

Why WordPress sites get hacked

Attackers targeting WordPress are almost never sitting at a keyboard manually picking on your business. They run automated bots that sweep millions of sites, looking for known vulnerabilities in specific plugin versions, weak or reused passwords, default usernames, and open login pages with no rate limiting. Your site is one of many on the list. The goal is not usually to hurt you personally. It is to plant spam links, redirect your visitors, steal customer data, or use your server to send malicious email.

Step 1: Keep core, themes, and plugins updated

This one change closes more attack surface than everything else on this list combined. WordPress core, your active theme, and every installed plugin should be on the latest stable version at all times. Most hosts let you turn on automatic updates for WordPress core and plugins. Turn them on.

One caveat: auto-updates can occasionally break something if a plugin update conflicts with your theme or another plugin. The fix for that concern is not to skip updates. It is to have a staging environment and a backup, so if something breaks you can roll it back in minutes. More on backups below.

Step 2: Only install reputable plugins and remove anything unused

Every plugin you install is a potential entry point. Not every plugin developer patches security flaws quickly, and some plugins are outright abandoned. Before installing anything, check: when was it last updated? Does it have recent reviews? Has it been tested with your version of WordPress? If a plugin has not been updated in over a year, look for an alternative.

Then go through what you already have. Deactivated plugins still count. If it's installed on your server, it can still be exploited. Delete anything you are not actively using.

• Prefer plugins with 10,000 or more active installs and recent update history.
• Check the WordPress plugin repository for the "Last updated" date before installing.
• Delete, not just deactivate, plugins you no longer use.
• Avoid installing more than one plugin per function. Redundant tools multiply your risk.

Step 3: Use strong passwords and two-factor authentication

Credential stuffing, where attackers try username and password combinations leaked from other sites, is one of the most common ways WordPress admin accounts get taken over. If your admin password is reused anywhere else, change it today. Use a password manager to generate a long random password, and never reuse it.

Two-factor authentication (2FA) makes a stolen password nearly useless on its own. A plugin like WP 2FA or Wordfence Login Security can add this in under 10 minutes. For any site handling customer data or transactions, 2FA is not optional.

Step 4: Limit login attempts and change your admin username

WordPress's default login URL is yoursite.com/wp-admin. Every bot knows this. You can move it with a plugin, but more important is what happens when someone lands there: by default, WordPress lets them try as many passwords as they like. That has to change.

A login-attempt limiter will lock out an IP after a few failed tries. Most security plugins include this. While you are at it, look at your admin account username. If it is "admin," that is half the login a bot needs. Create a new administrator account with a non-obvious username, delete the "admin" account, and reassign any content.

Step 5: Use a security plugin or a host with a firewall

A web application firewall (WAF) sits between the internet and your WordPress installation, blocking known malicious traffic before it ever reaches your site. You can get this two ways: through a security plugin like Wordfence or Sucuri, or through your hosting provider if they offer server-level protection.

Wordfence's free tier is solid for most small business sites. It includes a firewall, malware scanner, and login protection. Hosts like WP Engine, Kinsta, and SiteGround build security layers in at the server level, which is slightly more robust because the protection happens before WordPress even loads.

Step 6: Take automatic off-site backups

Backups do not prevent an attack. They determine how bad the recovery is. A clean backup from yesterday means your downtime is measured in hours, not days, and you may not need to pay for an expensive cleanup at all. No backup means you are rebuilding from scratch, or paying someone else to attempt a recovery from a compromised state.

Two rules for backups. First, they must be automatic. A backup you have to remember to run will not be there when you need it. Second, they must be off-site. A backup stored only on the same server as your compromised site can be deleted or encrypted by the same attack. Store backups in a separate location, such as Google Drive, Dropbox, or Amazon S3.

1. 1Install a backup plugin such as UpdraftPlus, BackupBuddy, or Jetpack Backup.
2. 2Set daily backups for sites that change frequently, weekly for static brochure sites.
3. 3Connect the plugin to an off-site destination: Google Drive, Dropbox, or Amazon S3.
4. 4Test a restore at least once. A backup you have never restored is a backup you do not know works.
5. 5Keep at least 30 days of backups so you can go back far enough to find a clean version.

Step 7: Force HTTPS and keep your SSL certificate current

SSL is table stakes in 2026. Every site should load over HTTPS. If yours still shows a warning in the browser address bar, that is a security problem and a credibility problem. Most hosts provision free SSL certificates through Let's Encrypt with one click.

Once SSL is active, force all traffic to HTTPS. You can do this in your hosting control panel or with a plugin like Really Simple SSL. Also check that your WordPress Address and Site Address in Settings are both set to the https:// version of your URL. A mixed-content warning, where some page elements still load over http, is a common mistake after adding SSL.

Step 8: Have someone watching the site

All of the above assumes you check on your site regularly. Most small business owners do not, and that is honest, they are running their business. The sites that get left compromised for months are the ones that nobody is monitoring. A security plugin with email alerts, or an uptime monitor like UptimeRobot, at least tells you when something is wrong.

The more complete answer is to have a person responsible for the site. Whether that is a staff member or an agency on retainer, someone should be logging in monthly, reviewing update reports, and checking that backups are running. We handle this for clients throughout the Pacific Northwest and across the US and Canada. An hour a month of attention prevents weeks of cleanup.

The site that gets hacked is not the one running WordPress. It is the one that nobody has looked at in eight months.

The full WordPress security checklist

Run through this once when you set up a new site, and revisit it quarterly:

1. 1Enable automatic updates for WordPress core, all active plugins, and your theme.
2. 2Delete every plugin and theme you are not actively using.
3. 3Change your admin username away from "admin" to something non-obvious.
4. 4Set a strong, unique password (20 or more characters, never reused) for all admin accounts.
5. 5Enable two-factor authentication for every admin user.
6. 6Install a login attempt limiter or configure it through your security plugin.
7. 7Install a security plugin with a firewall and malware scanner, or upgrade to a managed host that provides this.
8. 8Set up automatic daily or weekly off-site backups and test a restore.
9. 9Force HTTPS sitewide and confirm your SSL certificate auto-renews.
10. 10Set up uptime monitoring and security alert emails so you know immediately when something changes.

When to hand this off to an agency

Most business owners can work through this checklist once. Staying on top of it every month, monitoring alerts, vetting plugins before installing them, testing backups: that is where it gets hard to sustain without someone whose job it is. A website maintenance plan from an agency handles all of this in the background. You get the peace of mind, none of the hours.

It is also worth noting that if your site is ever compromised, a professional cleanup is faster and more thorough than a DIY attempt. Malware can embed itself in multiple locations, and a partial cleanup leaves you vulnerable to re-infection. If you discover a hack, take the site offline and call someone who does this for a living.