How to secure a WordPress website

Make a complete backup of the database and wp-content, including uploads, themes and plugins. Keep at least one copy outside the web server, such as in encrypted cloud storage or on a local device.

Do not assume a backup is usable because a plugin says it completed. Restore a copy on a staging site or separate installation before you rely on it. Backups left in a publicly reachable folder can expose database credentials and other sensitive data, so remove old server-side copies or protect their storage carefully.

Open Dashboard → Updates and update WordPress, active plugins and themes. Delete plugins and themes you no longer use rather than leaving them installed. Turn on automatic updates where they are appropriate, but review major changes and check the site afterwards.

WordPress applies minor and security updates automatically on supported installations, but you still need a process for major core updates, plugins, themes and the hosting stack. Take a backup first, especially before updating a busy WooCommerce site or a site with custom code.

Give each person their own account, use the least permissive role they need, remove dormant users and avoid predictable usernames such as admin. Use a unique password of at least 20 characters, stored in a password manager, for every WordPress, hosting, SFTP and database account.

Enable two-factor authentication for administrators and editors. WordPress does not provide built-in 2FA in its standard documentation, so this normally requires a maintained plugin. HTTPS must cover the login and administration areas so passwords and session cookies are not sent in clear text.

Use SFTP rather than unencrypted FTP where your host supports it. Ask your host to check file ownership and permissions instead of applying 777 broadly; world-writable files make it easier for an attacker to alter your site and incorrect changes can take the site offline.

Disable the WordPress dashboard’s theme and plugin file editor by adding define( 'DISALLOW_FILE_EDIT', true ); to wp-config.php. This limits one route to code execution after an administrator account is compromised, but it does not stop malicious uploads or protect the hosting account itself.

For a small site, the manual controls above may be enough if you review updates, backups and user accounts regularly. For a shop, membership site or site that cannot be watched closely, add a firewall, malware scanner, login protection, 2FA, IP controls and audit logging.

Use automatic blocking carefully. Permanently blocking individual IP addresses is often unreliable because addresses can be shared, reassigned or rotated. A firewall can also cause false positives that break backups or normal admin requests, so test checkout, logins, forms and scheduled jobs after enabling stricter rules.

If you want one dashboard for the ongoing work, install and activate SecuPress Pro from the WordPress Plugins screen, then follow its setup wizard. Configure the firewall, malware scans, real-time alerts, 2FA, IP blocking, audit logs and database backup options, and review the first scan for warnings.

SecuPress Pro is a practical shortcut because it brings those controls together, but it does not replace strong hosting credentials, HTTPS, tested off-site backups or timely updates. Avoid running several security plugins with overlapping firewalls, login limits or scans, because their rules can conflict and make troubleshooting harder.