WordPress Security Basics

The most effective WordPress security basics are ordinary operational controls carried out consistently: supported software, controlled access, secure hosting, tested backups and prompt response to unusual activity.

1. Control the accounts

• Use a password manager and unique passwords
• Enable multi-factor authentication where the chosen system supports it
• Create named accounts rather than sharing “admin”
• Give editors and suppliers the lowest practical role
• Remove access when a person or contract leaves
• Protect the administrator email and hosting account as carefully as WordPress

2. Keep the complete stack supported

Update WordPress core, themes, plugins, PHP and the database through a documented process. An inactive plugin or theme can still contain exploitable code while it remains on the server.

3. Use legitimate software sources

Download WordPress from the official project and themes/plugins from trusted, verifiable suppliers. Avoid nulled commercial extensions and unknown bundles.

4. Protect transport and configuration

• Serve administration and public pages over HTTPS
• Use SFTP or another encrypted management method where available
• Restrict file permissions appropriately
• Do not expose debug messages, server paths or secrets publicly
• Keep configuration and API credentials out of shared documents and public repositories

5. Make backups independent and testable

Minimum backup coverage

Item	Why it matters
Database	Contains posts, settings, users and many plugin records
Uploads	Contains business media and documents
Themes and custom code	Needed to reconstruct presentation and bespoke functions
Plugin/configuration record	Supports a clean rebuild even when unsafe code should not be restored blindly
Off-site copy	Remains available if the hosting account is lost or damaged

6. Reduce the attack surface

• Remove unused accounts, themes and plugins
• Disable public registration unless needed
• Limit exposed services and unnecessary integrations
• Review file uploads and form handling
• Keep the plugin set restrained and documented

7. Monitor and respond

Set alerts for uptime, unexpected administrator changes, failed critical tasks and suspicious behaviour. A warning without an owner and response procedure offers little protection.

Do not rely on hiding WordPress

Changing login URLs or version strings can reduce noise, but should not replace updates, access control and server security. The official hardening guidance emphasises layered controls rather than obscurity alone.

Monthly owner check

• All updates reviewed
• Backups recent and restorable
• Users and roles current
• Forms and checkout working
• No unexplained plugins or administrators
• Security and uptime alerts reaching the correct person

Practical next step

Run the monthly owner check now and record every failed item with a responsible person and completion date.

Protect the recovery chain

An attacker who controls the administrator email, domain account or hosting account may bypass WordPress-level controls. Use strong authentication and separate recovery methods for these upstream accounts. Keep recovery codes away from the same device and mailbox they protect.

Changes that need extra caution

• Installing code from outside the official or verified supplier source.
• Giving a support worker temporary administrator or hosting access.
• Enabling debug output on a public site.
• Changing PHP or database versions without staging and rollback.
• Restoring a backup without preserving recent transactions.

Temporary access should have an expiry date and be removed after the task.

Sources and date checked

This guide was checked on 21 July 2026. WordPress, hosting environments and extensions change, so recheck the relevant official documentation before making a major change.

• WordPress security handbook
• Hardening WordPress
• WordPress plugin management documentation