How to protect a WordPress site from cyber attacks

Back up both the WordPress files and the database before changing security settings. Store at least one copy outside the hosting account, then confirm that you can restore it or ask your host to confirm the restore process.

A backup that has never been restored is an assumption, not a recovery plan. This matters because a firewall rule, update or permission change can make a site unavailable.

Go to Dashboard → Updates and update WordPress, every active plugin and the active theme. Enable automatic updates where they suit your site, but keep backups because an update can conflict with a theme or plugin.

Delete plugins and themes you do not use rather than leaving them deactivated. Choose software that is actively maintained, and do not keep abandoned copies around as future attack paths.

Give each person a separate account, use the least powerful role they need, remove old users and avoid predictable administrator usernames. Use a long, unique password for every administrator account and turn on two-factor authentication for administrators.

Force the dashboard and login process over HTTPS. WordPress core does not provide two-factor authentication for normal administrator logins, so you need a reputable plugin or an identity provider for that control.

At minimum, ask your host for a managed web application firewall and login rate limiting. In wp-config.php, disable the dashboard file editor with define( 'DISALLOW_FILE_EDIT', true );, after taking a backup. Use sensible file ownership and permissions, and protect the file containing your database credentials.

You can also disable or restrict XML-RPC if your site does not need it. Check first: Jetpack, the WordPress mobile app and some integrations rely on it, so a blanket block can break them. Manual hardening is fine for a small, low-risk site if you can maintain it, but it does not give you one place for malware scans, activity logs, alerts and two-factor authentication.

Review failed logins, new administrator accounts, unexpected plugin or theme changes and unusual traffic. Set email alerts for important security events, and check that your host, backup system and firewall are still reporting normally.

If the site is hacked, do not simply delete the visible bad file and carry on. Put the site into a controlled maintenance state, preserve logs, change hosting, database, WordPress and administrator passwords, scan the files and restore from a known-clean backup or use a professional incident response service.

For most live sites, install WP Cerber Security and configure its firewall, login protection, two-factor authentication, malware scanning, activity monitoring and email alerts. Review its XML-RPC, REST API, bot and anti-spam settings rather than enabling every restriction without checking what your site uses.

This is faster than assembling separate controls, especially when you need a firewall, malware and integrity checks, brute-force protection and ongoing alerts. Keep updates, HTTPS, least-privilege accounts and tested backups in place: the plugin is an additional layer, not a replacement for them.