Knowing how to secure a WordPress site comes down to a short list of habits, and most of them need no code at all. WordPress’s own handbook describes security as reducing risk, not eliminating it.
Quick answer: The short version of how to secure a WordPress site: keep WordPress, plugins and themes updated. Use strong passwords and two-step login. Give each person only the access they need. Keep tested backups somewhere other than your server, and load every page over HTTPS. The 15-step checklist below marks which steps you can do yourself and which need your host or a developer.
Your host looks after the server. The WordPress install, its plugins and its logins are yours, and the handbook says that is where most problems start. This guide to how to secure a WordPress site is written for business owners, not system administrators.
Why the basics matter more than the tools
Most WordPress security best practices are habits, not products. WordPress itself is rarely the weak point. Patchstack’s State of WordPress Security in 2026 counted 11,334 new vulnerabilities reported across the WordPress ecosystem in 2025: 91% in plugins, 9% in themes, and six in WordPress core.
Those are reported vulnerabilities, not proven causes of hacks. You will often read that “plugins cause most hacks,” but that line is widely repeated without a primary source. What the figures do show is where known weaknesses sit, so learning how to secure a WordPress site starts with what you install and how you keep it updated.
The same report found that 46% of those vulnerabilities had no fix from the developer when they were made public. Updates matter, but they shouldn’t be your only layer.
How to use the checklist: it breaks the question of how to secure a WordPress site into 15 steps, so work from top to bottom. The “Who” column says whether you can do a step yourself or need your host or a developer. Each step links to the WordPress.org page it is based on.
How to secure a WordPress site in 15 steps
| # | Step | Where | Who | Source |
|---|---|---|---|---|
| 1 | Confirm automatic security updates are on | Dashboard → Updates | You | Managing Updates |
| 2 | Turn on auto-updates for plugins and themes | Plugins screen; Appearance → Themes | You | Auto-updates |
| 3 | Delete plugins you don’t use | Plugins screen | You | Hardening |
| 4 | Install plugins and themes only from WordPress.org or well-known companies | Before installing | You | Hardening |
| 5 | Use a long, unique password for every account | Users → Profile | You | Hardening |
| 6 | Turn on two-step login for every administrator | A two-step login plugin | You | Two-step login |
| 7 | Don’t use “admin” or “webmaster” as a username | Needs a database change | Developer | Hardening |
| 8 | Give each person the lowest role that fits; delete unused accounts | Users screen | You | Roles |
| 9 | Keep “Anyone can register” off unless you need sign-ups; if on, default new users to Subscriber | Settings → General → Membership | You | General Settings |
| 10 | Load every page over HTTPS | SSL certificate from your host | Host | HTTPS |
| 11 | Run PHP 8.3 or newer | Hosting control panel | Host | Requirements |
| 12 | Keep off-site backups of files and database, and test a restore | Host or backup plugin | You + host | Hardening |
| 13 | Check Site Health monthly and fix critical issues | Tools → Site Health → Status | You | Site Health |
| 14 | Turn off the dashboard file editor | define( ‘DISALLOW_FILE_EDIT’, true ); in wp-config.php | Developer | Hardening |
| 15 | Put a firewall in front of WordPress | Plugin, host or cloud service | You or host | Hardening |
Nine of the 15 steps need no one but you. Two more you can do yourself or hand to your host, and the last four need your host or a developer. That split is the honest answer to how to secure a WordPress site when you don’t have a developer on call.
What each step means in plain English
Updates and plugins (steps 1–4)
WordPress has updated itself automatically since version 3.7, and every site applies minor releases by default. Check Dashboard → Updates to confirm nothing has switched them off.
Plugins and themes only auto-update if you opt in, one at a time, a feature added in WordPress 5.5. WordPress then runs those updates twice a day and emails you the results. For a bigger change on a busy site, try it on a staging copy of your site first.
If you only remember one thing about how to secure a WordPress site, make it this: keep everything updated and remove what you don’t use.
Logins and people (steps 5–9)
A strong password avoids your name, your company name, dictionary words and short strings. WordPress shows a strength meter whenever you change it. WordPress’s brute-force guide recommends a password manager, which makes this part of how to secure a WordPress site almost effortless: you never have to remember or reuse a password.
Two-step login asks for a code from your phone as well as your password. WordPress doesn’t include it out of the box, so you need a plugin; the handbook lists several, the Two-Factor plugin among them. If your host doesn’t already limit repeated login attempts, the same brute-force guide says a security plugin can, though it prefers limits set by your host or CDN.
Attackers try usernames like admin and webmaster first, the handbook notes. Renaming an existing account means a database change, so ask your developer.
WordPress has six built-in roles. A Subscriber can only manage their own profile, while an Administrator can do everything, including installing plugins. Most people who update content don’t need Administrator, and the brute-force guide advises keeping the number of administrators low.
Your own computer is part of how to secure a WordPress site too. The handbook warns that no amount of WordPress security helps if there is a keylogger on the computer you log in from, so keep it free of malware and keep your browser and operating system updated.
Hosting basics (steps 10–12)
Your host can’t decide how to secure a WordPress site for you, but it plays a part in the next three steps. WordPress works over HTTPS once an SSL certificate is installed, and WordPress.org recommends HTTPS support for every install. Your host installs the certificate, often at no cost.
The same page recommends PHP 8.3 or greater. Older versions still run WordPress but have reached end of life and may expose your site to vulnerabilities.
When you or your developer connect to the server, use SFTP rather than plain FTP: the handbook explains that SFTP encrypts your password instead of sending it in the clear. On shared hosting, a compromised neighbor can affect your site, so ask your host what precautions it takes.
For backups, the handbook recommends regular snapshots of your whole site, files and database, kept somewhere you trust. Keep several: a hack can go unnoticed for days, and an older copy may be the only clean one. Our guide to WordPress backups covers setting them up.
Checks and developer settings (steps 13–15)
Site Health, under Tools, has a Status tab that lists critical issues and recommended improvements.
The dashboard file editor lets anyone with an administrator login change plugin and theme code. The handbook calls it often the first tool an attacker uses after logging in. One line in wp-config.php turns it off, and your developer can add it.
These are the parts of how to secure a WordPress site best left to a developer, who can also tighten file permissions. The handbook’s example scheme sets folders to 755 and files to 644, and wp-config.php to 400 or 440 so only you and the web server can read it. If your site doesn’t use XML-RPC, the brute-force guide recommends disabling it, because it is a frequent target for password-guessing attacks.
Firewalls come in three kinds, per the handbook: plugins that filter requests (it names Wordfence and All in One WP Security as examples), a firewall on your web server, and a cloud service that filters traffic before it reaches your host.
What a checklist can’t do
No checklist on how to secure a WordPress site makes it hack-proof. The handbook says plainly that prevention is sometimes not enough, which is why it recommends monitoring so you can react faster.
Uptime monitoring tells you when the site goes down. Blacklist monitoring tells you when search engines start warning visitors away, which WordPress.org lists as a clear sign of a hack.
Knowing how to secure a WordPress site is one job; doing it every week is another. If you’d rather hand the routine to someone else, see what our team takes care of.
Frequently asked questions
Can I learn how to secure a WordPress site without a developer?
Yes, for most of it. Nine of the 15 steps in this checklist are dashboard settings and habits you can handle yourself. The rest involve your host or a developer.
How do I know if my WordPress site has been hacked?
WordPress.org lists clear signs: Google or Bing blacklists the site, your host disables it, it is flagged for malware, or you see changes you didn’t make, such as new user accounts. If you see any of these, write down what you noticed and when, scan your own computer for malware, and contact your host. The same page says to change every password, including WordPress, SFTP, your hosting panel and the database, and to change them again once the site is clean. Then come back to this guide on how to secure a WordPress site so it doesn’t happen again.
Can you password protect a WordPress site?
You can password protect individual posts and pages by setting their visibility to “Password protected” in the editor. Your host or developer can also add server-side password protection, but WordPress’s brute-force guide now recommends scoping it narrowly, for example to the login page, rather than locking the whole admin area.
Is WordPress secure?
WordPress core has a strong record: Patchstack counted six core vulnerabilities in 2025, all low priority. Older versions don’t receive security updates, though, so the version you run matters as much as the platform. That is why most advice on how to secure a WordPress site focuses on plugins, themes and updates rather than WordPress itself.
Do I need a security plugin?
A plugin is one layer, not the whole job. The handbook describes firewall plugins, server firewalls and cloud firewall services as options, and two-step login usually needs a plugin too. A plugin won’t keep your other plugins updated or test your backups, so the rest of this guide to how to secure a WordPress site still applies.
Bottom line
Security for a business site is mostly routine: update, trim, lock down logins, back up and check. Start with the nine steps marked “You” this week, since they need nobody’s help. Then send your host one email about HTTPS, PHP and backups, and ask a developer about the file editor, file permissions and a firewall. That is how to secure a WordPress site without turning it into a second job.
