Keep WordPress secure

Most WordPress sites that get broken into are not targeted by name. Automated tools scan the web for outdated software, weak passwords and leftover plugins. This guide lists the habits that close those gaps. It is for site owners and anyone who manages a WordPress site, and none of the steps need programming knowledge.

Keep everything up to date​

Updates fix security holes as well as bugs. Outdated plugins and themes are a common way in, because once a fix is published, the weakness it fixes becomes public too.

• Update WordPress itself, every plugin and every theme, including inactive ones.
• Check Dashboard > Updates at least weekly, or turn on automatic updates where you are comfortable with them.
• Take a backup before large updates. Update WordPress safely explains the safest order.

Protect every account​

Use strong, unique passwords. Each account needs a long password used nowhere else. A password manager makes this practical. Reused passwords are dangerous because a leak on another site can unlock yours.

Turn on two-factor authentication. Two-factor authentication (2FA) asks for a second proof, usually a code from an app on your phone, after the password. WordPress does not include it by default, so install a well-maintained two-factor plugin from the official plugin directory and turn it on for every administrator.

Limit administrator accounts. Give administrator rights only to people who install plugins or manage users. Editors and authors can do most day-to-day work. See the roles table in Get started with WordPress.

Check who has access​

Open Users every few months and look for:

• Accounts for people who no longer work on the site. Delete them and give their content to another user when WordPress asks.
• Administrators you do not recognise. An unknown administrator can be a sign the site has been compromised. See What to do if your website is hacked.
• Old shared logins. Replace them with one account per person, so you always know who did what.

Remove what you don't use​

An inactive plugin or theme still sits on the server, and its files can still be attacked if they contain a weakness. Delete plugins you no longer use, and keep only your active theme plus one default WordPress theme as a fallback for troubleshooting.

Install only from trusted sources​

Get themes and plugins from the official wordpress.org directories or straight from the developer's own website.

Keep backups you can restore​

A backup is your way back if anything goes wrong. A good backup:

• Includes both the files and the database.
• Runs automatically and is kept for several weeks, so you can go back to before a problem started.
• Is stored away from the site itself, or at least outside the website folder.
• Has been tested: restore it at least once, for example to a staging copy, so you know it works.

See Backups and restores.

Use HTTPS everywhere​

HTTPS encrypts the connection between visitors and your site, so passwords and form entries cannot be read on the way. Install an SSL certificate, set both addresses in Settings > General to https://, and redirect all http:// traffic. See SSL certificates explained and Fix mixed content after switching to HTTPS.

Turn off the built-in file editor​

WordPress has an editor that lets administrators change theme and plugin code from the dashboard. If someone takes over an administrator account, they can use it to add harmful code. Turn it off by adding this line to wp-config.php, above the line that says /* That's all, stop editing! */:

define( 'DISALLOW_FILE_EDIT', true );

You can still change code by editing files over SFTP. Edit wp-config.php with care and keep a copy of the original first. See Upload files with SFTP.

Security plugins​

A security plugin can add features such as limits on failed sign-in attempts, a firewall that filters harmful requests, file change alerts and malware scans. Choose one well-maintained plugin rather than several, because overlapping security plugins can conflict or lock you out. A plugin helps, but it does not replace updates, strong passwords and backups.

Related guides​

• Update WordPress safely
• Protect your hosting account
• What to do if your website is hacked
• Backups and restores