How to Secure a WordPress Website: Practical Security To Protect Your Websites From Hackers

How to Secure a WordPress Website: Practical Security Steps I Use When Building and Managing Sites

A secure WordPress website is not created by installing one security plugin and forgetting about it. From my experience designing and managing WordPress websites, I have found that security is built from several small decisions: keeping WordPress and its plugins updated, controlling who has administrator access, removing software you no longer need, maintaining reliable backups, using HTTPS, protecting the login area, and paying attention to unusual activity.

When I build or work on a WordPress website, I do not treat security as something to add after the design is finished. I consider it part of the website setup itself. A website can look excellent on the front end and still be poorly protected behind the scenes.

The most practical way to secure a WordPress website is therefore to reduce the number of things that can go wrong, make unauthorized access harder, and make sure you have a way to recover the site if something does happen.

This guide focuses specifically on those WordPress security practices.

What I Check First When Securing a WordPress Website

When I take responsibility for a WordPress website, I don’t begin by installing several security plugins.

I first look at the basics:

• Is WordPress up to date?
• Are the plugins and theme still maintained?
• Who has administrator access?
• Are there unused plugins or themes?
• Is the website using HTTPS?
• Is there a reliable backup?
• Are there unnecessary user accounts?
• Is the hosting account properly secured?
• Is the website using plugins from trustworthy sources?
• What happens if the website is compromised tomorrow?

These questions tell me more about the actual security condition of a website than simply seeing a security plugin installed.

I have also learned an important lesson from working on websites over time: security and maintenance are connected, but they are not the same thing. Maintenance keeps the website healthy; security is specifically concerned with preventing unauthorized access and limiting the damage if something goes wrong.

For that reason, I keep the security discussion here focused on WordPress itself rather than turning this into another general website-maintenance guide.

1. Keep WordPress Core Updated

One of the first things I check is the WordPress version.

WordPress releases updates for different reasons, including security fixes. The same applies to plugins and themes.

An outdated installation creates a situation I would rather avoid: running software with a known problem when an update is already available.

Before updating a live website, however, I don’t blindly click every update button.

I consider what is installed on the site, especially when several plugins work together or when the website has custom functionality.

For important websites, I prefer having a current backup before making major updates. That gives me something to fall back on if an update causes a compatibility problem.

This is one reason I recommend treating backups as part of the security process rather than as an unrelated task.

2. Keep Your Plugins Under Control

WordPress becomes powerful because of plugins, but plugins also increase the number of components you have to maintain.

I have worked on websites where plugins were installed for a particular purpose and then left there long after that purpose had disappeared.

That creates unnecessary clutter.

If a plugin is no longer being used, I ask whether it really needs to remain installed.

There is a difference between a plugin being inactive and being completely unnecessary. An inactive plugin is still software sitting inside your WordPress installation. If you don’t need it, removing it can simplify the website.

My approach is simple:

Install what the website actually needs. Keep it updated. Remove what is no longer needed.

This is especially important on websites that have gone through several redesigns. If you are still deciding what your WordPress website actually needs before launch, I also recommend reviewing my practical guide to creating a professional website from the beginning.

3. Be Careful About Where You Get WordPress Plugins

I would rather spend time finding a reputable plugin than install an unknown plugin simply because someone says it is free.

A plugin can have access to important parts of a WordPress installation. That means the source matters.

Before installing a plugin, I look at things such as:

• Who developed it?
• Is it actively maintained?
• When was it last updated?
• Is it compatible with the current WordPress version?
• Does it have a credible user base?
• Does the plugin actually solve a problem I have?

I avoid downloading modified or pirated versions of premium plugins.

The promise of getting a paid plugin for free is not worth giving unknown code access to a website.

For a business website, author website or publishing website, I would rather use fewer trustworthy plugins than fill the website with software simply because it looks useful.

4. Protect the WordPress Administrator Account

The administrator account deserves special attention because it has extensive control over the website.

If somebody gains administrator access, they may be able to install plugins, change settings, create users, modify content and potentially damage the entire website.

This is why I don’t treat the WordPress administrator password like an ordinary password.

Use a strong, unique password.

Do not reuse the same password for your WordPress dashboard, hosting account and email account.

Those accounts are connected to the operation of your website, but they should not all depend on the same password.

If one password is exposed, reusing it elsewhere can turn one compromised account into several compromised accounts.

5. Don’t Give Everyone Administrator Access

This is one of the simplest security mistakes to prevent.

If someone only needs to write articles, they don’t necessarily need administrator privileges.

If someone needs to edit content, give them the role appropriate to that work.

Administrator access should be reserved for people who genuinely need to manage the entire WordPress installation.

I have learned to look at user permissions as part of website structure. The question isn’t:

“Can I give this person admin access?”

The better question is:

“What level of access does this person actually need?”

Giving someone more access than necessary creates unnecessary risk.

6. Use Two-Factor Authentication Where Available

A strong password is important, but I don’t want the password to be the only barrier protecting an important account.

Two-factor authentication adds another verification step when someone attempts to sign in.

That matters because passwords can be exposed through phishing, password reuse, compromised devices or other methods.

Where two-factor authentication is available for the relevant WordPress or hosting account, I consider it an important additional layer.

It does not replace good passwords or other security measures.

It simply means that knowing the password alone is not necessarily enough.

7. Make Sure the Website Uses HTTPS

When I build or review a website, HTTPS is one of the basic things I expect to see.

A website using HTTPS has a secure connection between the visitor’s browser and the website.

You can usually identify it by the https:// at the beginning of the website address and the security indicator displayed by the browser.

This becomes particularly important when a website has:

• Contact forms
• Login forms
• Customer information
• Payment functionality
• Newsletter subscriptions
• Other information submitted by visitors

SSL is sometimes treated as a design detail because visitors see the padlock or security indicator.

I see it differently.

It is part of the technical foundation of the website.

8. Secure the Hosting Account Too

WordPress security does not stop at /wp-admin.

The hosting account is another important part of the website’s security.

If someone obtains access to your hosting account, they may have much greater control than someone who merely gets into WordPress.

They may be able to access website files, databases, email settings, domains or other websites under the same account, depending on the hosting setup.

For this reason, I also pay attention to the credentials used to access hosting.

Use a strong unique password and enable additional account protection where the hosting provider supports it.

If your domain registrar, hosting account and email account all use weak or reused passwords, securing only WordPress leaves a major part of the setup exposed.

9. Keep a Real Backup Before You Need One

A backup becomes valuable when something goes wrong.

That sounds obvious, but it is surprisingly easy to discover that a supposed backup isn’t useful when you actually need it.

My experience rebuilding Creativity Publications reinforced this lesson for me. The website had existed for years, and after the domain expired, content that had been on the old site was no longer available in the way I needed it.

That experience changed the way I think about website ownership.

Don’t assume that because something has been online for years, it will always be there.

For a WordPress website, a useful backup should give you a realistic way to recover the website’s important files and database.

And don’t just create a backup and forget about it.

Know where the backup is stored and, where practical, verify that it can actually be used for recovery.

For the broader side of keeping a website healthy after it has been built, see my guide on how I approach ongoing website maintenance.

10. Don’t Keep Unused Themes and Plugins

When I inherit or redesign a WordPress website, one thing I often look at is what has accumulated inside the installation.

You may find:

• Old plugins
• Themes that are no longer being used
• Plugins installed for testing
• Duplicate functionality
• Abandoned software
• Temporary tools that were never removed

A website can accumulate this stuff over time.

I prefer keeping the WordPress installation clean.

If the website is running one active theme, there may still be reasons to retain a default WordPress theme for troubleshooting, but there is usually no good reason to keep a collection of obsolete themes and plugins simply because they are sitting there.

The goal is not to achieve a magical plugin number.

The goal is to understand what is installed and why it is there.

11. Be Careful When Installing “Free” Premium Plugins

This deserves its own warning.

One of the things I would never recommend is downloading a pirated or “nulled” version of a premium WordPress plugin.

Someone may tell you:

“It is exactly the same plugin. You just don’t have to pay.”

You cannot safely make that assumption about modified software.

A WordPress plugin has access to your website. If the copy has been altered, you are introducing code that you did not obtain from the original developer.

For a website that represents a business, ministry, author, publishing company or personal brand, saving the cost of a plugin is not worth gambling with the entire website.

12. Protect the Login Page From Repeated Attacks

WordPress websites are commonly exposed to automated login attempts.

You may not know that your website is being targeted because these attempts can happen automatically.

A practical security setup can help limit repeated failed login attempts and detect suspicious activity.

Some security plugins provide this functionality.

The important thing is not to install every security feature you find.

Choose a sensible security setup and understand what it is doing.

I prefer knowing how a security tool is configured rather than installing several overlapping plugins and hoping they protect the website.

13. Use a Security Plugin Carefully

A reputable WordPress security plugin can be useful.

Depending on the tool, it may provide features such as:

• Malware scanning
• Login protection
• Security alerts
• Firewall functionality
• Suspicious activity monitoring
• File-change detection
• Brute-force protection

But I don’t consider the security plugin itself to be the security strategy.

If WordPress is outdated, administrator passwords are weak, unnecessary plugins are installed and there is no usable backup, installing a security plugin does not magically fix the underlying problems.

The plugin is one layer.

The website’s overall setup is what matters.

14. Watch for Suspicious Users and Changes

This is something I would check when managing a WordPress website, especially one that has several people working on it.

Look at the user accounts.

Do you recognize every administrator?

Are there old accounts belonging to people who no longer work on the website?

Are there unexpected changes to important settings?

A strange administrator account can be a serious warning sign.

If you suddenly notice an unfamiliar user, unexpected plugin installation, unusual redirects or changes you did not make, don’t simply delete the visible problem and move on.

Investigate how it got there.

That distinction matters.

Removing the symptom without identifying the cause can leave the underlying problem untouched.

15. Don’t Give Plugins More Responsibility Than Necessary

One lesson I have learned from building WordPress websites is that adding another plugin is easy.

Removing a plugin later can be much harder if the website has become dependent on it.

This matters for security because every additional component requires maintenance.

Before installing something, I ask:

Does this solve a real problem on this website?

If the answer is no, I don’t install it just because the feature sounds interesting.

This also helps keep troubleshooting manageable.

When something goes wrong, it is much easier to understand a website with a deliberate setup than one containing dozens of plugins whose purposes nobody remembers.

Keeping unnecessary plugins under control can also help with the wider goal of keeping a WordPress website fast and responsive.

16. Keep Your WordPress Environment Organized

Security is easier to manage when you know what you have installed.

This becomes particularly important when you are building websites for clients or managing your own website over several years.

Document the important parts of the setup.

For example:

• Hosting provider
• Domain registrar
• WordPress administrator accounts
• Important plugins
• Theme
• Backup system
• Security system
• Email configuration
• Important integrations

You don’t need a complicated cybersecurity document.

You simply need enough information to answer:

“If something goes wrong today, do I know where everything is and how the website is connected?”

That knowledge can save considerable time during troubleshooting.

17. Don’t Make Security Changes on a Live Website Carelessly

This is especially important when working on an established website.

Before changing security settings, plugins, caching configuration, database-related settings or other important components, I want a way to recover if the change causes a problem.

I follow the same principle when working on website performance.

Before making significant changes, create a backup.

A website can be functioning perfectly, and then one apparently harmless change can create a conflict.

That is why I don’t treat backups as something you only need after a website has been hacked.

They are useful before ordinary technical work too.

If you are preparing a new site for launch, it is also worth working through the security and technical checks before making the website public. My guide on launching a small business website properly covers that broader preparation process.

18. Check the Website After Security Changes

Installing a security feature is not the end of the job.

Test the website afterwards.

For example:

• Can visitors still access the website?
• Does the WordPress login work?
• Do contact forms still submit?
• Do important pages load?
• Are redirects working?
• Are images displaying?
• Can administrators perform their normal tasks?
• Is HTTPS working correctly?

I have found that website work often involves interconnected parts.

A change intended to improve one area can affect another.

This is why I prefer testing the actual website rather than assuming that a successful installation means everything is fine.

The same principle applies when making technical changes for performance. If you are working on speed and technical performance, testing Core Web Vitals after making website changes is more useful than assuming the changes worked.

What I Would Check on a WordPress Website Today

If I were handed a WordPress website to secure, this is the order I would work through.

WordPress installation

• Is WordPress current?
• Is the active theme current?
• Are important plugins current?
• Are abandoned plugins present?

Accounts

• Who has administrator access?
• Are passwords unique and strong?
• Is two-factor authentication available?
• Are old users still active?

Plugins and themes

• Are all installed plugins necessary?
• Are they from trustworthy sources?
• Are any abandoned or suspicious?
• Are there unnecessary themes installed?

Website connection

• Is HTTPS working?
• Is the SSL certificate valid?
• Are important forms working?

Recovery

• Is there a current backup?
• Where is it stored?
• Is the backup actually usable?

Monitoring

• Is suspicious activity being monitored?
• Are unexpected users or changes being noticed?
• Is the website being checked regularly?

That gives me a much more useful picture of the website’s security than simply asking whether a security plugin has been installed.

What I Would Not Do to Secure a WordPress Website

There are also a few things I avoid.

I would not install five security plugins

More plugins do not automatically mean more security.

They can introduce overlapping features and make the website harder to manage.

I would not download nulled plugins

The potential risk is far greater than the money saved.

I would not give everyone administrator access

Access should match the person’s actual responsibility.

I would not ignore WordPress updates for months

An old installation is not something I want to leave unattended.

I would not depend entirely on a security plugin

Security needs several layers.

I would not wait until the website is hacked before thinking about backups

By then, the most important question becomes whether you can recover.

These are the kinds of mistakes I try to eliminate when working through a website before launch. If you are reviewing your own site for other problems at the same time, my guide to common website mistakes beginners make can be used as a separate checklist rather than mixing those issues into this security article.

A Simple WordPress Security Routine

You don’t have to spend hours every day working on website security.

What matters is consistency.

When WordPress or plugins need updating

Check the website and make sure important updates are applied appropriately.

Regularly

Review:

• Administrator accounts
• Plugins
• Themes
• Security alerts
• Backup status
• Unexpected website changes

Before major changes

Create a backup.

After major changes

Test the website.

That routine is much more realistic for a small business owner, author, church, freelancer or blogger than trying to become a cybersecurity specialist.

WordPress Security Is About Reducing Risk

I don’t think of WordPress security as trying to make a website completely impossible to attack.

That isn’t a realistic way to approach website security.

I think about reducing unnecessary risk.

Keep the software maintained.

Use trustworthy plugins.

Protect administrator and hosting accounts.

Limit unnecessary access.

Use HTTPS.

Maintain usable backups.

Monitor the website.

And don’t ignore unusual changes.

Those are not complicated ideas, but they make a significant difference when they are actually implemented.

The biggest mistake is treating security as a single feature that you install once.

A WordPress website is software, and software needs attention.

The more deliberately you build and manage the website, the easier it becomes to keep it secure.

Building websites has taught me that many website problems don’t begin with something dramatic.

They often begin with small things that nobody paid attention to.

An old plugin remains installed.

An administrator account is forgotten.

A password is reused.

A backup is assumed to exist but has never been tested.

A plugin is downloaded from an unknown source because it was free.

Months later, someone discovers that the website has a problem.

I would rather deal with these things before they become emergencies.

That is the approach I take when building and managing WordPress websites: keep the installation purposeful, keep access under control, keep the software maintained, maintain a recovery option, and pay attention to what is happening on the website.

Security is not a decoration you add to a finished WordPress website.

It is part of building the website properly in the first place.