How to secure a WordPress website

Make a complete backup of the database and WordPress files before changing security settings. The database contains posts, pages, comments and settings, while the files include the core installation, plugins, themes, uploads and configuration. You need both parts for a full restore.

Store the backup somewhere separate from the hosting account and check that you can restore it. If the site is already hacked, do not assume the newest backup is clean; use a known-good copy, then change WordPress, hosting, SFTP, database and email passwords.

Update WordPress, every active plugin and the active theme from the Dashboard, then check the front end and important forms. WordPress recommends keeping core, plugins and themes up to date because old software is a common route for exploit attempts.

Delete plugins and themes you do not use rather than leaving them deactivated. Choose extensions that are actively maintained, and take a backup before major updates. If an update leaves the site showing a maintenance message or a blank page, use your host or SFTP access to restore the affected files and backup.

Review Users and remove old accounts, unknown administrators and accounts belonging to former contractors. Give each person the lowest role they need: for example, use Editor for someone managing content rather than Administrator. WordPress roles control access to posts, settings, plugins, themes and users.

Use a long, unique password for every administrator and enable two-factor authentication through your hosting provider or a security plugin. Do not rely on hiding the login URL alone; it does not replace strong authentication, rate limits or monitoring.

Install an SSL certificate, make sure the WordPress and Site Address values use https://, and redirect HTTP traffic to HTTPS at the server or hosting level. Test the login page, forms, images and embedded content afterwards. WordPress documents additional configuration for forcing secure administration and logins.

Disable the built-in plugin and theme file editor by adding define( 'DISALLOW_FILE_EDIT', true ); to wp-config.php. Keep that file outside public access where your hosting setup supports it, restrict who can read it, and never publish debug logs where visitors can download them.

Ask your host to confirm that files and directories are not world-writable. WordPress commonly uses 644 for files and 755 for directories, with stricter access for wp-config.php, but the correct values depend on the server user and hosting setup. Do not apply 777 as a quick fix: incorrect permissions can expose the site or break updates.

Use hosting logs or a security tool to watch failed logins, unexpected administrator accounts, changed files and suspicious redirects. If you find malware, take a snapshot for investigation, restore clean files where possible, identify the entry point and rotate credentials after recovery. Restoring an infected backup without fixing the original weakness can bring the problem back.

The manual route is fine for a small site when you can keep updates, backups, access reviews and monitoring on a regular schedule. It becomes harder to maintain when the site has WooCommerce, several administrators, frequent changes or no one available to inspect logs.

For faster coverage, install and configure WPMU DEV Defender Pro. Its firewall, malware scanning, brute-force protection, hardening controls, two-factor authentication, activity monitoring and audit logs handle much of the work in one place. Still keep independent backups and review alerts; a plugin does not protect an abandoned WordPress installation or replace secure hosting.