Top 10 Tips to Keep Your WordPress Site Secure

WordPress is flexible, widely supported, and easy to extend with plugins and themes. That flexibility is one of its biggest strengths, but it also means site owners need to take security seriously.

Most WordPress attacks are automated. Bots scan for vulnerable plugins, weak passwords, exposed backup files, outdated themes, open XML-RPC endpoints, default usernames, and poor hardening. If your site has one of those common gaps, it may be targeted even if your website is small.

The good news is that WordPress security does not have to be complicated. A strong setup comes from a few practical habits: keep everything updated, use strong login protection, avoid nulled software, back up the site, harden risky features, monitor vulnerabilities, and scan for malware regularly.

This guide covers the best WordPress security practices every site owner should follow, with practical notes on where SiteFort Security Plugin and the Securewp Remote Security Scanner can help.

1. Avoid Nulled Plugins and Themes

Using paid plugins or themes for free may look tempting, but nulled WordPress software is one of the fastest ways to compromise a website.

Nulled plugins and themes often contain hidden backdoors, malware, spam injectors, redirect scripts, fake license code, or code that allows attackers to regain access later. Even if the software appears to work normally, the malicious code may stay quiet until the attacker decides to use it.

There is also another problem: nulled software does not receive safe updates from the original developer. That means known vulnerabilities remain open.

What to do

• Only install plugins and themes from trusted sources.
• Use WordPress.org, official vendor websites, or reputable marketplaces.
• Remove any nulled plugin or theme already installed.
• Replace it with a legitimate copy.
• Scan the site for backdoors after removing nulled software.

If you have ever used a nulled plugin or theme, run a malware scan and reset administrator, hosting, SFTP/FTP, and database passwords. SiteFort can help check for suspicious files, backdoors, malicious PHP, injected scripts, modified core files, and exposed sensitive files.

2. Keep WordPress, Plugins, and Themes Updated

Outdated plugins and themes are a common entry point for WordPress hacks.

When a developer releases a security update, attackers may reverse-engineer the change to find the vulnerability in older versions. After that, bots can scan the web for sites still running the vulnerable release.

WordPress’ official security guidance recommends keeping WordPress core, plugins, and themes updated, and using software that is actively maintained.

What to do

• Update WordPress core regularly.
• Update plugins and themes as soon as security updates are available.
• Remove unused plugins and themes instead of leaving them deactivated.
• Replace abandoned plugins that are no longer maintained.
• Test major updates on staging before applying them to business-critical sites.

SiteFort helps by monitoring known vulnerabilities in WordPress core, plugins, and themes, so you can identify risky components before attackers exploit them.

3. Use Strong, Unique Passwords

Weak and reused passwords are still a major risk.

Attackers do not only try to guess passwords. They also use leaked credential lists from other breaches. If an administrator reused the same password elsewhere, the WordPress login may be compromised even without a plugin vulnerability.

Protect these accounts:

• WordPress administrator accounts
• Hosting control panel
• SFTP/FTP accounts
• Database users
• Cloudflare or DNS accounts
• Email accounts used for password resets

What to do

• Use long, unique passwords for every account.
• Use a password manager.
• Do not reuse passwords across websites.
• Remove old or unused user accounts.
• Check for weak or breached passwords.

SiteFort includes weak and breached password checks, helping administrators reduce login risk before an account is abused.

4. Enable Two-Factor Authentication

Two-factor authentication adds an extra step after the password. Even if an attacker gets the correct password, they still need the second factor to log in.

For WordPress administrators, 2FA is one of the most valuable security improvements you can make.

Authenticator apps are usually a better option than SMS because SMS can be vulnerable to SIM-swap and phone-number takeover attacks.

What to do

• Enable 2FA for all administrator accounts.
• Use an authenticator app where possible.
• Store recovery codes safely.
• Consider role-based 2FA for editors, shop managers, and other privileged users.

SiteFort includes role-based 2FA options, including authenticator app support, email-based verification, and recovery codes.

5. Limit Login Abuse and Brute-Force Attempts

WordPress login pages are constantly targeted by bots. Even if they do not guess the password, repeated login attempts can create server load and fill logs with noise.

Login protection should include more than one control.

What to do

• Limit failed login attempts.
• Use CAPTCHA or bot checks where appropriate.
• Use safer login error messages.
• Consider a custom login URL as an extra noise-reduction layer.
• Block repeated abusive IPs.
• Rate-limit login requests.

A custom login URL can help reduce automated noise, but it should not be treated as the main defense. Strong passwords, 2FA, rate limiting, and brute-force protection matter more.

SiteFort includes brute-force protection, CAPTCHA, safer login responses, custom login URL support, and rate-limiting controls.

6. Keep Reliable Off-Site Backups

Backups are not a security feature by themselves, but they are essential for recovery.

If your site is hacked, damaged by a bad update, or broken during migration, a clean backup can save hours or days of work.

The important word is clean. A backup is only useful if it was taken before the infection or before the site broke.

What to do

• Use automatic backups.
• Store backups off-site, not only inside the same hosting account.
• Keep multiple restore points.
• Test backup restoration periodically.
• Do not leave ZIP or SQL backup files in public directories.
• Protect backup storage with strong authentication.

For active business sites, daily backups are a good baseline. For WooCommerce or membership sites, you may need more frequent database backups.

7. Disable File Editing in the WordPress Dashboard

WordPress includes a built-in file editor for theme and plugin files. If an attacker gets administrator access, this editor can make it easier to inject malware or backdoors directly from the dashboard.

Disable dashboard file editing by adding this line to wp-config.php:

define( 'DISALLOW_FILE_EDIT', true );

This does not stop developers from editing files through SFTP, Git, or deployment tools. It only removes the built-in editor from WordPress admin.

SiteFort can apply this hardening option from the WordPress dashboard, along with other common hardening controls.

8. Use Safe File Permissions

Incorrect file permissions can let attackers modify files, upload malware, or expose sensitive configuration data.

As a general baseline:

• Directories should usually be 755
• Files should usually be 644
• wp-config.php can often be more restrictive, such as 600 or 640, depending on hosting setup

WordPress documentation explains that file permissions control who can read, write, modify, and access files on the server.

Do not set files or folders to 777 unless a trusted host specifically instructs you for a temporary troubleshooting reason. Public write permissions create unnecessary risk.

9. Protect Sensitive Files and Directories

Some files should never be publicly accessible from the browser.

Check for exposure of:

• wp-config.php
• .env
• .git and .svn directories
• Database backup files
• ZIP or TAR backup files
• debug.log
• error_log
• Old installer files
• Public staging or test folders

Move backups outside the public web root, disable directory browsing, and remove old test copies of WordPress.

The Securewp Remote Security Scanner is useful here because it checks what can be seen from outside the site. SiteFort can also help identify sensitive file exposure and apply hardening rules from inside WordPress.

10. Block PHP Execution in Uploads

The WordPress uploads directory should contain media files, not executable PHP scripts.

Many backdoors are placed inside wp-content/uploads because the directory is writable. If PHP execution is allowed there, an attacker may be able to run a web shell or malicious script.

What to do

• Block PHP execution in wp-content/uploads.
• Scan uploads for suspicious PHP files.
• Investigate any executable files found in media folders.
• Keep uploads writable only as needed by WordPress.

SiteFort includes hardening controls to help block PHP execution in risky directories and scan for suspicious files.

11. Disable or Restrict XML-RPC

xmlrpc.php is a legacy WordPress endpoint used by some mobile apps, Jetpack features, and third-party integrations.

If your site does not use XML-RPC, disabling it can reduce brute-force attempts, pingback abuse, and automated request noise. If your site needs XML-RPC, restrict it carefully and apply rate limiting instead of leaving it open to everyone.

SiteFort can help disable or restrict XML-RPC through hardening and firewall controls.

12. Secure the REST API Carefully

Older security guides sometimes recommend disabling the REST API completely. That is not a good default for modern WordPress sites.

The REST API is used by the block editor, dashboard features, plugins, themes, forms, WooCommerce, mobile apps, and integrations. Fully disabling it can break normal functionality.

What to do

• Do not expose sensitive custom endpoints publicly.
• Require authentication for private or write-capable endpoints.
• Reduce user enumeration where possible.
• Rate-limit suspicious API activity.
• Monitor REST API abuse in logs.

SiteFort helps with safer hardening controls, including reducing user enumeration without blindly breaking normal WordPress features.

13. Use SSL and HTTPS Everywhere

HTTPS encrypts data between the visitor’s browser and your server. It helps protect login credentials, form submissions, checkout data, cookies, and admin sessions from being exposed in transit.

Google has also used HTTPS as a lightweight ranking signal since 2014.

What to do

• Install a valid SSL certificate.
• Redirect HTTP to HTTPS.
• Update WordPress Address and Site Address to HTTPS.
• Fix mixed content warnings.
• Use HTTPS for admin, forms, checkout, and account pages.

Most modern hosts provide free SSL certificates through Let’s Encrypt or similar providers.

14. Use a Firewall and Bot Protection

A firewall helps block suspicious requests before they reach vulnerable parts of your site.

For WordPress, firewall and bot protection can help reduce:

• Brute-force login attempts
• Bad bot traffic
• Fake crawlers
• Vulnerability scans
• Suspicious query strings
• Repeated 404 probing
• Abusive IPs or user agents
• XML-RPC abuse

SiteFort includes firewall protection, bot blocking, IP and country blocking, user-agent blocking, rate limiting, 404 probe controls, and community threat intelligence. If your site uses Cloudflare, SiteFort can sync selected block rules to Cloudflare so some traffic is blocked earlier at the edge.

15. Scan for Malware and Backdoors

A site can look normal and still contain malware. Backdoors, web shells, injected JavaScript, spam links, redirect scripts, and modified core files can stay hidden until they are triggered.

Regular scanning helps detect problems early.

Scan for:

• Backdoors
• Web shells
• Malicious PHP
• Injected JavaScript
• SEO spam
• Suspicious redirects
• Modified core files
• Vulnerable plugins and themes
• Exposed sensitive files

SiteFort uses a performance-focused, hash-first scanning approach with cloud-assisted malware analysis for suspicious files. The Securewp Remote Security Scanner is also useful for checking public-facing issues such as visible malware indicators, suspicious redirects, blacklist status, and exposed information.

16. Monitor Activity Logs

Security logs help you understand what changed and when.

Monitor events such as:

• Successful logins
• Failed login attempts
• New user creation
• User role changes
• Plugin installation or deletion
• Theme changes
• Firewall blocks
• Hardening setting changes
• Malware scan results
• Vulnerability findings

SiteFort includes audit logs so you can review important security events from the WordPress dashboard and investigate suspicious activity faster.

Quick WordPress Security Checklist

• Use only trusted plugins and themes.
• Remove nulled software immediately.
• Keep WordPress, plugins, and themes updated.
• Use strong, unique passwords.
• Enable two-factor authentication.
• Limit login attempts and bot abuse.
• Keep reliable off-site backups.
• Disable file editing in WordPress admin.
• Use safe file permissions.
• Protect sensitive files and directories.
• Block PHP execution in uploads.
• Disable or restrict XML-RPC if unused.
• Secure REST API access carefully.
• Use HTTPS everywhere.
• Use firewall and bot protection.
• Scan for malware and backdoors.
• Monitor activity and security logs.

How SiteFort and the Securewp Remote Scanner Help

The Securewp Remote Security Scanner gives you an outside view of your site. It helps identify visible security issues, blacklist status, malware indicators, suspicious redirects, and exposed public-facing risks.

SiteFort Security Plugin works inside WordPress. It helps with hardening, firewall protection, login security, 2FA, vulnerability alerts, malware scanning, audit logs, bot blocking, rate limiting, and Cloudflare Sync.

Used together, they give you two useful perspectives:

• Remote scanner: What visitors, search engines, and attackers may see from the outside.
• SiteFort plugin: What is happening inside WordPress files, users, plugins, themes, settings, and security events.

Final Thoughts

WordPress security is not about one magic setting. It is about reducing risk layer by layer.

Start with the basics: avoid nulled software, keep everything updated, use strong passwords and 2FA, maintain clean backups, harden risky features, protect sensitive files, and monitor for suspicious activity.

For quick external checks, run the Securewp Remote Security Scanner. For ongoing WordPress protection, use SiteFort to manage hardening, firewall rules, login protection, vulnerability alerts, malware scanning, audit logs, and Cloudflare Sync from one dashboard.

You may also find this guide helpful: How to Secure a WordPress Website from Hackers.