Key Takeaways
- Outdated plugins are the most common WordPress attack vector — keeping all plugins, themes, and WordPress core updated is the single most impactful security practice.
- Two-factor authentication on admin accounts prevents the majority of brute-force and credential-stuffing attacks.
- Daily automated backups stored off-site (not just on the same server) ensure you can recover from a compromise without paying a ransom or rebuilding from scratch.
- HTTPS (SSL) is both a security measure and a ranking signal — every WordPress business site should be running on HTTPS.
- Security plugins (Wordfence, Sucuri) add meaningful protection but are not a substitute for keeping plugins and WordPress core updated.
WordPress sites are compromised every day — not through sophisticated targeted attacks, but through automated bots scanning millions of sites for a small set of well-known vulnerabilities. An outdated Contact Form 7 plugin with a known SQL injection flaw. An admin account with the password 'password123'. A login page accessible at the default /wp-admin URL, exposed to unlimited password guessing attempts. The majority of WordPress security breaches are preventable. Not by implementing enterprise-grade security infrastructure, but by consistently applying a set of practices that take a few hours to set up and a few minutes per month to maintain. This guide organises WordPress security measures by priority — starting with the changes that prevent the most common attacks, and working through to the more comprehensive hardening steps that significantly reduce the remaining attack surface.
Definition: SQL Injection and XSS in WordPress Context
SQL Injection is an attack where malicious SQL code is inserted into a form field or URL parameter that is passed unsanitised to the database — allowing the attacker to read, modify, or delete database content, potentially including all user accounts and site content. Cross-Site Scripting (XSS) is an attack where malicious JavaScript is injected into a web page — typically through user-submitted content or a compromised plugin — that then executes in the browsers of other users visiting the page, potentially stealing session cookies or redirecting users to phishing sites. Both attack types are exploited through vulnerable WordPress plugins that do not properly sanitise user input. Keeping plugins updated closes known vulnerabilities of both types. A Web Application Firewall (WAF) — provided by Wordfence Premium, Sucuri, or Cloudflare — adds a filter that blocks known attack patterns even against unpatched vulnerabilities.
Priority One: Updates and Strong Credentials
Keeping WordPress core, plugins, and themes updated — combined with strong admin credentials — prevents the vast majority of WordPress compromises.
Enable automatic updates for WordPress core minor releases (security patches) through the WordPress dashboard or by adding `define('WP_AUTO_UPDATE_CORE', 'minor');` to wp-config.php. For plugins, review the WordPress auto-update capability added in WordPress 5.5 — you can enable auto-updates for individual plugins from the Plugins page. Be selective: auto-update plugins that you trust and that are actively maintained; manually review updates for plugins you have customised or that are critical to your site's operation. Check your plugin list monthly and deactivate and delete any plugins that haven't been updated in over a year — unmaintained plugins are a growing vulnerability over time.
Admin account credentials are the second most common attack vector. If your admin username is 'admin' — the WordPress default, and the first username brute-force attacks try — create a new admin account with a different username, log in with it, and delete the original 'admin' account. Use a long, randomly generated password (20+ characters) stored in a password manager — not a memorable word or phrase. Every person who needs admin access should have their own separate account, never sharing a single admin login. This ensures actions can be attributed to individuals and a compromised password affects only one account.
Two-factor authentication (2FA) adds a second verification step to the login process — typically a time-based code from an authenticator app (Google Authenticator, Authy) that must be entered alongside the password. Even if an attacker obtains your password through a data breach or brute force, they cannot log in without access to your authenticator app. Implement 2FA on all admin accounts using a plugin like WP 2FA or through the Two Factor plugin maintained by the WordPress security team. This single measure makes brute-force attacks against your admin login effectively useless.
- Enable auto-updates for WordPress core minor releases and trusted plugins
- Audit plugins monthly — remove unmaintained or unused plugins immediately
- Change admin username from 'admin' to something unique
- Use 20+ character randomly generated passwords on all admin accounts
- Enable two-factor authentication on every admin and editor account
Backups and Monitoring: What to Do When Prevention Fails
Daily automated backups stored off-site and a malware scanning solution ensure you can detect and recover from a compromise quickly, without losing your site or paying a ransom.
Every WordPress business website needs daily automated backups stored somewhere other than the same server hosting the website. If your site is compromised and your backup is stored in the same hosting account, attackers who gain access to your hosting can delete or corrupt the backup alongside the live site. Backup to a separate service: Amazon S3, Google Drive, or Dropbox are common destinations. The UpdraftPlus plugin automates scheduled backups and supports remote storage to all major cloud services. Keep at least 30 days of backup history — malware is sometimes present for weeks before detection, and you need to be able to restore to a point before the infection.
A malware scanner detects compromises that have already occurred — an essential complement to prevention measures. Wordfence's free scanner compares your WordPress files against the official WordPress repository and known clean copies of plugins, flagging files that have been added or modified unexpectedly. Sucuri's SiteCheck scanner analyses your site's publicly visible pages for malware indicators. Run a manual scan monthly as part of your maintenance routine, and enable Wordfence's email notifications for critical security events (admin login from new location, plugin file changes, blocked attacks from known malicious IPs).
Limit login attempts to prevent brute-force attacks. WordPress allows unlimited login attempts by default — a bot can try millions of password combinations without being blocked. Wordfence, Limit Login Attempts Reloaded, or your hosting provider's WAF can block an IP address after a configurable number of failed attempts (typically 5–10). Additionally, changing the default login URL from /wp-admin and /wp-login.php to a custom URL (using a plugin like WPS Hide Login) removes your login page from the automated scans that target the default path.
Additional Hardening: Further Reducing Your Attack Surface
Beyond the essentials, server configuration and WordPress hardening measures add additional layers of protection against less common attack vectors.
Disable the WordPress file editor in the admin dashboard by adding `define('DISALLOW_FILE_EDIT', true);` to wp-config.php. The Theme and Plugin editors in WordPress admin allow direct PHP file editing from the browser — if an attacker gains access to your admin dashboard, this is a direct route to code execution on your server. Most site owners don't use these editors directly (they use FTP or the hosting file manager), and disabling them removes the capability without any practical loss.
Set correct file permissions on your WordPress installation. WordPress files should be readable by the web server but not writable (644 for files, 755 for directories). The wp-config.php file, which contains your database credentials, should be 640 or 600 — readable by the web server user, not by other system users. Your hosting provider's control panel typically manages these, but if you manage your own server, audit permissions with `find /path/to/wordpress -type f -perm 777` and correct any files with world-writable permissions.
Install a Web Application Firewall. Cloudflare's free tier provides a WAF that filters malicious traffic before it reaches your server — blocking known attack patterns, DDoS mitigation, and reducing the load from automated scanning bots. Wordfence Premium's endpoint WAF runs at the WordPress application level and uses Wordfence's threat intelligence feed to block attack patterns identified across their entire customer base. Combining a network-level WAF (Cloudflare) with an application-level WAF (Wordfence) provides defence in depth.
Experience Signal
The security audit pattern we see most often is a WordPress site that hasn't had its plugins updated in 6–12 months, an admin account still named 'admin', and no security plugin or WAF in place. After a breach — usually discovered when Google Search Console flags the site for malware or the hosting provider suspends it for sending spam — the cleanup costs more in developer time and reputation damage than a year of maintenance would have. The irony is that the practices that prevent 97% of WordPress compromises are not technically demanding — they're maintenance habits. Establishing a monthly maintenance routine covering updates, backup verification, and a quick Wordfence scan takes 20 minutes and eliminates the vulnerability that accounts for the vast majority of attacks.
Frequently Asked Questions
WordPress's market dominance — over 40% of all websites — makes it an attractive target for automated attacks. Attackers don't target individual WordPress sites manually; they run bots that scan the internet for sites running outdated WordPress versions, vulnerable plugins, or common misconfigurations (default table prefixes, exposed login pages, admin usernames called 'admin'). A single successful attack pattern deployed against millions of WordPress sites generates profitable returns for attackers through spam distribution, credential theft, or hosting resource exploitation. The same popularity that makes WordPress a safe, well-supported choice also makes it the most probed CMS on the web.
Outdated plugins are the single most common attack vector for WordPress sites, accounting for the majority of successful intrusions. WordPress core is updated quickly when vulnerabilities are found, and most site owners keep WordPress core reasonably current. Plugins — particularly premium plugins distributed through channels without automatic update notifications, and free plugins whose developers have abandoned maintenance — accumulate vulnerabilities over time and are not always updated promptly. The second most common cause is weak or reused passwords on admin accounts. Third is purchasing or using nulled (pirated) premium plugins and themes, which are frequently distributed with malware pre-embedded.
Yes, but with important caveats. Security plugins like Wordfence, Sucuri Security, and iThemes Security add real protection: they detect and block brute-force attacks on the login page, scan files for known malware signatures, monitor for file changes that might indicate a compromise, and add firewall rules that block malicious traffic. What security plugins cannot do is protect against vulnerabilities in your plugins and theme — if an outdated plugin has a SQL injection vulnerability, a WAF (Web Application Firewall) adds a layer of protection but is not a substitute for updating the plugin. Security plugins complement best practices; they don't replace them.
Sources
Not Sure How Secure Your WordPress Website Is?
Webnixon conducts WordPress security audits and implements the full range of protection measures — updates, 2FA, WAF, backups, and monitoring — for business websites that can't afford downtime or a data breach.
Book a WordPress Security AuditAbout the author
David Okafor
Developer
David is a full-stack developer at Webnixon with expertise in React, WordPress, and custom web application development. He contributes to complex front-end builds, API integrations, and performance-focused engineering for Webnixon clients. He writes about web development best practices, WordPress, and the technical side of building fast, maintainable websites.
Related Articles
Web Design
How to Speed Up a WordPress Website: A Practical Performance Guide
Page speed is a confirmed Google ranking factor, and 53% of mobile users abandon sites that take longer than three seconds to load. For WordPress sites — which power over 40% of the web — performance is often degraded by plugin bloat, unoptimised images, and inadequate hosting. This guide covers every layer of the problem.
Web Design
HTTPS and SSL: Why Every Business Website Needs to Make the Switch
Google began marking HTTP websites as 'Not Secure' in Chrome in 2017. For businesses, this is no longer a back-burner technical task — a browser security warning directly undermines visitor trust and conversion rates. Here is what HTTPS means, what it costs, and how to switch without breaking your site.
WordPress
10 Signs Your WordPress Site Needs a Rebuild (Not Just a Refresh)
If your WordPress site is slow, hard to update, fragile, or failing conversion goals, a rebuild often delivers better long-term ROI than repeated cosmetic refreshes. This guide includes Ontario context, practical checklists, and a clear action framework for business owners.