How to secure a WordPress site

Update WordPress core, active plugins and active themes from the dashboard. Remove plugins and themes you do not use rather than leaving them installed. Download WordPress only from the official WordPress project, and check that updates do not break forms, payments or scheduled jobs.

Do not update everything blindly on a busy production site. Take a backup first and update during a quiet period. If an update causes a fatal error, restore the backup or ask your host to help roll back the affected component.

Give each person their own account, remove old users, and use a unique password of at least 20 characters for every administrator. Reduce permissions: most editors do not need administrator access. Enable two-step authentication through a trusted authentication solution, and secure your hosting, database and email accounts as well as WordPress.

Do not rely on hiding the login URL or changing the administrator username as your main defence. A stolen administrator session can bypass those tricks.

Enable an SSL certificate at your host, make the site load at its HTTPS address, and check that images, scripts and forms do not still load over HTTP. In WordPress, confirm the site and home addresses use HTTPS. If you manage the server, require HTTPS for the dashboard and logins with define( 'FORCE_SSL_ADMIN', true ); in wp-config.php.

Ask your host whether it provides a web application firewall, malware scanning, activity logs and automatic backups. Server-level filtering can block malicious requests before WordPress loads, but misconfigured rules can also block legitimate administrators, so keep a way to disable or adjust them.

Back up the database and WordPress files on a schedule that matches how often the site changes. Keep copies outside the hosting account, protect them from public web access, and test restoring one before you need it. A backup that has never been restored is only an assumption.

Do not fix a backup-folder permission warning by casually setting directories to 0777. Publicly reachable backup files can expose credentials, and a restore from an already-infected backup can put the compromise straight back. Check the backup path and ask your host or plugin support for the correct ownership and permissions instead.

Use the least permissive file permissions that work with your host. A common starting point is files at 644 and directories at 755, but ownership and server configuration matter more than copying numbers from a checklist. Never make the whole WordPress directory writable just to silence an error.

Disable the built-in dashboard editor by adding define( 'DISALLOW_FILE_EDIT', true ); to wp-config.php. This reduces what an attacker can do after gaining an administrator account, but it does not stop malicious uploads or repair an already-compromised site. Keep this file backed up before editing it, and place the setting before the line that says WordPress has stopped editing.

Review administrator accounts, recently installed extensions, unexpected files and hosting access logs. Watch for changed core or plugin files, new redirects, spam pages, unfamiliar scheduled tasks and unexplained administrator logins. If the site is already showing suspicious changes, do not simply reinstall WordPress and carry on; identify and remove the vulnerable entry point first.

The manual route can protect a small, stable site, but it depends on you remembering recurring scans, login protection, firewall rules and file checks. For the fast route, use Security Ninja Premium to combine vulnerability scans, firewall protection, brute-force login controls, file monitoring, scheduled scans, logging and security recommendations in one WordPress plugin. Review its alerts rather than enabling every aggressive rule without checking your checkout, forms and admin access.