Securing WordPress

Securing WordPress: Basic Protection Against Attacks, Malware, and Brute Force

WordPress is widely used globally and is therefore an attractive target for automated attacks. Most attacks are not specifically directed at a single small website, but rather run automatically: bots search for outdated plugins, weak passwords, insecure themes, open login pages, or known security vulnerabilities.

The good news: many typical risks can be significantly reduced with consistent maintenance, strong credentials, regular updates, clean user permissions, and a stable hosting environment. WordPress security is not a single switch, but an interplay of multiple measures.

Why WordPress Security Is So Important

A compromised website is not just a technical problem. It can endanger visitors, expose customer data, send spam, distribute malware, damage SEO rankings, or be flagged as insecure by browsers and search engines.

Possible consequences of a successful attack:

• Website shows third-party content or redirects,
• Login no longer works,
• Malware is injected,
• Spam pages are created,
• Search engines warn against the website,
• Contact forms are abused,
• Email delivery ends up on blacklists,
• Customer data may be at risk,
• Shop orders or payments are disrupted,
• Cleanup causes effort and costs.

Prevention is almost always easier than cleaning up a hacked website.

1. Keep WordPress, Plugins, and Themes Up to Date

Outdated software is one of the most common entry points. This affects not only WordPress itself, but especially plugins and themes. Many attacks exploit known security vulnerabilities for which updates would already be available.

Update regularly:

• WordPress Core,
• Plugins,
• Themes,
• Translations,
• PHP version,
• WooCommerce and payment plugins, if applicable.

For simple websites, automatic updates can make sense. For WooCommerce shops, membership areas, or complex websites, major updates should first be tested in a staging environment.

2. Do Not Keep Unnecessary Plugins and Themes

Every installed plugin and theme increases the attack surface. Even deactivated plugins and unused themes still reside as files on the server. If they are outdated, they can pose a risk.

Recommendations:

• Delete unneeded plugins,
• Do not keep deactivated plugins permanently,
• Remove unused themes,
• Keep one default theme as a fallback,
• Do not install plugins from unknown sources,
• Do not use "nulled" premium plugins,
• Regularly check the plugin list.

Plugin hygiene serves as both security maintenance and performance tuning.

3. Use Strong Passwords

Weak passwords are a major risk. Automated attacks frequently try common combinations, dictionary terms, and known password lists.

A good password:

• is long,
• is unique,
• is not reused on other websites,
• contains uppercase and lowercase letters, numbers, and special characters,
• is ideally stored in a password manager.

Do not use passwords like admin123, wordpress2024, company name plus year, or personal information.

4. Avoid the Username "admin"

The username admin is a frequent target in brute-force attacks. If attackers already know the username, they only have to guess the password.

Recommended procedure:

1. Create a new administrator with an individual username.
2. Log in with the new account.
3. Delete the old admin account.
4. Attribute existing content to the new user.

Avoid choosing a publicly visible name as your login username if it can be prevented.

5. Assign Administrator Rights Sparingly

Not every user requires administrator privileges. The more people who have full access, the higher the risk of misconfigurations, accidental changes, or compromised accounts.

Basic rule:

• Administrator: only for technical management.
• Editor: for complete content management.
• Author: for own posts.
• Contributor: for drafts without publishing.
• Subscriber: for simple user accounts.

External service providers should receive their own temporary accounts. Never share your personal administrator password.

6. Enable Two-Factor Authentication

Two-factor authentication, or 2FA, provides additional protection for the login. In addition to the password, a second factor is required, such as a code from an authenticator app.

2FA is highly recommended for:

• Administrators,
• Shop owners,
• Editors with extensive permissions,
• Web designer access,
• Support access,
• Websites with customer data.

2FA does not prevent every attack method, but it significantly increases login security.

7. Limit Login Attempts

In brute-force attacks, bots attempt to log in using numerous username and password combinations. Limiting login attempts can slow down such attacks.

Options:

• Security plugin with login limitation,
• 2FA,
• Strong passwords,
• Server-side protection,
• IP blocking for suspicious behavior,
• Monitoring of login attempts.

8. Only Install Trusted Plugins and Themes

Only install plugins and themes from reputable sources, such as the official WordPress directory, directly from the developer, or from well-known marketplaces. Avoid free copies of paid premium plugins.

Check before installation:

• When was the plugin last updated?
• Is it compatible with your WordPress version?
• What are the ratings and support history like?
• Is it actively maintained?
• Is there clear documentation?
• Does it require unnecessary permissions or external connections?

Nulled plugins and themes represent a significant risk. They can contain hidden malicious code and should never be used on production sites.

9. Disable File Editing in the Dashboard

Under certain conditions, WordPress allows administrators to edit theme and plugin files directly in the dashboard. This feature is convenient but risky. If an administrator account is compromised, an attacker can use it to insert malicious code.

You can disable file editing by adding the following line to your wp-config.php file:

define('DISALLOW_FILE_EDIT', true);

Insert the code above the line that indicates editing stops and WordPress is loaded.

10. Disable Directory Browsing

If directory browsing is active, visitors might be able to see folder contents directly in the browser if no index file is present. This should be avoided.

In many hosting environments, directory browsing is already disabled. If necessary, adding the following entry to the .htaccess can help:

Options -Indexes

Here too, always create a backup before making changes to .htaccess.

11. Use SSL Consistently

Your website should be fully accessible via HTTPS. SSL protects the transmission between the visitor and the server. This is particularly crucial for logins, contact forms, customer areas, and shops.

Check that:

• SSL certificate is active,
• Website loads via https://,
• HTTP redirects to HTTPS,
• No mixed content errors are present,
• WordPress Address and Site Address are set to HTTPS,
• Forms and login pages are securely accessible.

If a browser warning appears despite SSL, it is frequently due to a mixed content problem.

12. Create Regular Backups

Backups are a core component of any security strategy. They do not prevent an attack, but they enable recovery if something goes wrong.

A good backup includes:

• Files,
• Database,
• Uploads,
• Theme and plugins,
• Configuration files,
• For shops, current order data as well.

Do not store backups exclusively on the same server. An external copy is particularly vital.

13. Use Security Plugins Wisely

Security plugins can offer additional protection for WordPress. However, they are no substitute for updates, backups, or clean user management.

Typical features of security plugins:

• Firewall rules,
• Login limitation,
• 2FA,
• Malware scans,
• File change checking,
• Notifications for suspicious events,
• Blocking suspicious IP addresses,
• Hardening certain WordPress settings.

Well-known solutions include Wordfence, Solid Security, or similar security plugins. Choose a plugin that is actively maintained and fits your website.

14. Common Threats Explained

15. Protect wp-config.php and .htaccess

The files wp-config.php and .htaccess are particularly sensitive. They contain crucial configurations for WordPress and the server.

Recommendations:

• Do not edit files unnecessarily,
• Create a backup before making changes,
• Do not set access permissions too loosely,
• Do not publish credentials,
• Document changes,
• Ask support if unsure.

Incorrectly set rules in .htaccess can make your website inaccessible.

16. Do Not Set File Permissions Too Loosely

File permissions that are too open can present a security risk. In WordPress, files and folders should not be unnecessarily writable.

As a general rule, the following applies:

• Files: 644,
• Folders: 755.

Do not set broad permissions like 777 unless a reputable support explicitly recommends it and only temporarily. Permanent 777 permissions are a security risk.

17. Check for Unknown Administrators

Regularly review the user list under Users > All Users. Unknown administrators can be an indication of a compromise.

Pay attention to:

• Unknown user accounts,
• Unexpected administrator privileges,
• Old accounts of former employees,
• Temporary service provider access,
• Unusual email addresses,
• Accounts without a clear purpose.

Do not delete or reduce permissions hastily if you do not know the origin of an account. First check if it is required by a plugin, service provider, or integration system.

18. What to Do if You Suspect a Hack?

If your website behaves unusually, you should act quickly. The earlier a problem is detected, the better the chances of a clean recovery.

Warning signs:

• Third-party content on the website,
• Redirects to unknown pages,
• Browser or Google warnings,
• New unknown administrators,
• Unusual files in the web space,
• Spam pages in Google,
• Sudden email spam outbound,
• Massive performance issues,
• Unknown plugins or themes.

If you suspect a hack, you should not just let the website "keep running somehow". Document the current state for analysis, check backups, and contact support.

19. Avoid SEO Damage Caused by Hacks

Hacked websites are frequently abused for spam, redirects, or hidden content. This can heavily impact search engine rankings and trust.

After a cleanup, you should check:

• Google Search Console,
• Indexed pages,
• Spam URLs,
• Sitemap,
• Redirects,
• Meta titles and descriptions,
• Unknown files,
• User accounts,
• Backup and update status.

If Google issues a security warning, a review must be requested after the cleanup.

20. GEO: Security as a Trust Signal

GEO, or Generative Engine Optimization, also depends indirectly on security. AI-powered search and answer systems prefer clear, accessible, and trustworthy content. A compromised website can deliver false content, spam, or technical errors.

A secure WordPress website supports GEO through:

• Reliable content,
• Stable accessibility,
• Clean site structure,
• No hidden spam content,
• Correct technical delivery,
• Trustworthy user experience.

21. Common Mistakes in WordPress Security

• Ignoring updates: Known vulnerabilities remain open.
• Too many administrators: Risk of compromised accounts increases.
• Weak passwords: Brute-force attacks are made easier.
• Username admin: Attackers only need to guess the password.
• Nulled plugins: High risk of malware.
• No backups: Recovery becomes difficult or impossible.
• Leaving deactivated plugins: Unnecessary attack surface remains.
• No 2FA: Login remains unnecessarily weak.
• Insecure file permissions: Files can be manipulated more easily.
• Ignoring warning signs: A small infection can spread.

Recommended Security Checklist

1. Keep WordPress updated: Regularly update core, plugins, and themes.
2. Use strong passwords: Utilize a password manager.
3. Enable 2FA: Especially for administrators.
4. Avoid admin username: No login name admin.
5. Check user roles: Assign only necessary permissions.
6. Perform plugin hygiene: Delete unnecessary plugins and themes.
7. Do not use nulled plugins: Only use trusted sources.
8. Enable SSL: Use HTTPS consistently.
9. Create backups: Save regularly and externally.
10. Disable file editing: Set DISALLOW_FILE_EDIT if appropriate.
11. Disable directory browsing: If necessary with Options -Indexes.
12. Check logs and users: Take suspicious activities seriously.
13. Use staging for updates: Especially for shops and complex websites.

Frequently Asked Questions About WordPress Security

Is WordPress insecure?

WordPress is not automatically insecure. Risks frequently arise from outdated plugins, weak passwords, insecure themes, too many administrators, or lack of maintenance.

What is the most important security measure?

Regular updates, strong passwords, 2FA, backups, and plugin hygiene are among the most important fundamentals.

Should I install a security plugin?

A security plugin can be useful, but it does not replace maintenance, updates, and backups. Choose an actively maintained plugin and configure it carefully.

Why should I avoid the user admin?

Because this username is frequently tried first in automated login attacks.

Are deactivated plugins dangerous?

They are normally not executed, but they still reside as files on the server. Unnecessary plugins should be deleted.

What are nulled plugins?

These are illegally distributed copies of paid plugins or themes. They can contain malicious code and should never be used.

What does Brute Force mean?

In Brute Force attacks, bots attempt to gain access to the login through numerous password attempts.

What do I do if I suspect a hack?

Do not change files haphazardly. Secure the current state, check backups, note down irregularities, and contact support for analysis.