WordPress security: updates, plugins and hardening that actually matter

Most WordPress sites that get hacked are not breached through WordPress core. They are breached through outdated plugins and themes, weak or reused passwords, and hosting that offers little protection. If you keep everything updated, cut plugins you do not need, lock down logins and keep tested backups, you have handled most of the real risk. Hardening tweaks help, but they come after those basics.

This post goes deeper on WordPress specifically. For platform-neutral basics, start with our small business website security checklist.

Where WordPress risk actually comes from

WordPress powers a large share of the web, which makes it a target. Automated bots scan constantly for known vulnerabilities in popular plugins and themes, and for login pages that accept guessable passwords. Attacks are rarely personal; they are opportunistic.

Updates: the habit that matters most

Core

WordPress applies minor (maintenance and security) core releases automatically by default. Leave that on. Major releases add features and should be applied after a quick test, ideally on staging. WordPress 6.8, released in April 2025, switched password hashing to bcrypt, a stronger approach than the previous method. It is a good example of security improvements you only get by staying current.

Plugins and themes

Plugins are where most vulnerabilities live. Our approach:

• Update promptly. When a plugin releases a security fix, the vulnerability is effectively public. The window between disclosure and automated attacks can be short.
• Use auto-updates selectively. WordPress has supported plugin and theme auto-updates since version 5.5. For simple sites with well-maintained plugins, turning them on is reasonable. For stores and complex sites, test on staging, then update quickly.
• Remove what you are not using. Deactivated plugins can still be exploited if their files are on the server. Delete them.
• Update themes too, including parent themes when you use a child theme.

PHP

WordPress runs on PHP, and old PHP versions stop receiving security fixes. Your host should let you choose a currently supported PHP version. Test your site on it, then switch.

Plugin habits that keep you safe

Every plugin is code someone else wrote, running with access to your site. Before installing one, check:

1. Is it actively maintained? Look at the last update date and whether it is tested with the current WordPress version.
2. Is it widely used and well reviewed? Popular plugins are more scrutinized and fixed faster.
3. Does the vendor have a security track record? How quickly have past issues been patched?
4. Do you need it at all? A snippet of code or a feature already in your theme or host may do the job.
5. Where did it come from? Only WordPress.org or the developer's official site. Never nulled copies.

Fewer plugins also means faster pages. Our comparison of Elementor, Divi and Astra covers how theme and builder choices affect both speed and the number of moving parts.

Logins and user accounts

• Strong, unique passwords for every account, stored in a password manager.
• Two-factor authentication for all administrators and editors, using a reputable plugin or your host's tools.
• Limit login attempts or use a firewall that blocks brute-force attempts.
• Least privilege. Give people the lowest role that lets them do their job. Editors and authors do not need administrator access.
• Audit users regularly. Remove former staff, agencies and contractors. Never share one admin login.
• Avoid "admin" as a username. It is the first one bots try.
• Watch application passwords. WordPress supports application passwords for API access. Revoke any you do not recognize or no longer use.

Hardening steps worth doing

These are the configuration changes we apply on most builds. They reduce the damage an attacker can do and close off common paths:

• Disable file editing in the dashboard. Adding define('DISALLOW_FILE_EDIT', true); to wp-config.php removes the built-in theme and plugin editors, so a stolen admin login cannot be used to edit PHP from the browser.
• Enforce HTTPS everywhere. Use a valid SSL/TLS certificate and redirect all traffic to HTTPS.
• Restrict or disable XML-RPC if nothing on your site needs it. It is a common target for brute-force attempts. Some apps and services still use it, so check first.
• Correct file permissions. wp-config.php should not be readable by other users on the server. Your host or developer can set this properly.
• Block PHP execution in uploads. The uploads folder should hold images and files, not run code.
• Add security headers such as HSTS, X-Content-Type-Options and a sensible Content Security Policy where practical.
• Use a web application firewall. Either at the host, through a CDN service, or via a security plugin, to filter malicious requests before they reach WordPress.
• Unique salts and keys in wp-config.php, regenerated after any suspected breach.

Hardening that matters less than people think

Some popular advice offers little real protection:

• Hiding the WordPress version or the fact that you use WordPress. Bots test for vulnerabilities directly.
• Changing the database table prefix on an existing site. It is low value and easy to break.
• Renaming wp-admin alone. It can reduce login noise, but it is not a substitute for strong passwords and two-factor authentication.

These are not harmful when done carefully, but they should never come before updates, logins and backups.

Hosting does a lot of the work

A good host provides isolation between sites, current PHP versions, server-level firewalls, malware scanning, automatic backups and staging environments. Managed WordPress hosts handle more of this for you. We compared two options in SiteGround for business WordPress sites and WP Engine: when managed WordPress hosting is worth it, and our guide to choosing web hosting covers what to look for.

Backups and recovery

Security is also about how fast you recover:

• Automatic daily backups of files and database, more often for stores.
• Off-site copies stored separately from your hosting account.
• Retention long enough to go back before an infection that went unnoticed for a while.
• Tested restores. A backup you have never restored is a hope, not a plan.
• Uptime and change monitoring so you hear about problems before customers do.

A simple maintenance rhythm

The short version

Keep WordPress, plugins, themes and PHP updated. Use fewer, better-maintained plugins. Protect every login with a strong password and two-factor authentication. Choose a host with real security features, and keep tested off-site backups. Apply sensible hardening on top of that. WordPress is still our first choice for blogs and content-heavy sites, as we explain in why we still choose WordPress, and it stays a safe choice when someone owns its maintenance.

If you would rather not own that rhythm yourself, see our care and security plans or contact us.