Most security guides tell you the same thing: install a plugin, turn on 2FA, back up. That's true - but it's only the start. I approach WordPress security from the other side: I've done penetration testing for years, finding holes before the attackers did. When you know how an attacker thinks, you defend differently. This page isn't a list of plugins - it's the view of someone who has been on both sides of the wall.
Why WordPress sites are such a popular target
WordPress runs 40.1% of all websites (W3Techs, October 2026), and that's exactly what makes it a target. Attackers don't pick you personally: automated bots scan millions of sites looking for the weak link - an outdated plugin, a weak password or a wrong server setting.
Most hacks aren't the work of a "genius hacker". They're automation that found an open door nobody bothered to lock.
| Attack vector | How to prevent it |
|---|---|
| Outdated plugins and themes | Regular updates, and removing whatever is not in use |
| Brute force on the login page | Limited login attempts, 2FA, a hidden wp-login |
| SQL injection and XSS | Secure code plus a WAF |
| Wrong file permissions | Hardening at the server level |
| An exposed wp-config | Protection for sensitive files |
SSL/HTTPS - encryption Google expects and customers trust
SSL/TLS is the absolute foundation of every WordPress site. It encrypts the traffic between the browser and the server, so passwords, card details and customer data don't travel as plain text.
Google marks sites without SSL as "Not secure" and ranks them lower in search results. In short: no SSL, no trust, no SEO.
- A free SSL certificate from Let's Encrypt - every serious hosting company offers free SSL. If yours doesn't, that's a sign to change hosts.
- Redirect HTTP to HTTPS - every request to
http://must redirect automatically tohttps://through.htaccessor the server settings, not through a plugin. - HSTS - security at the browser level - HTTP Strict Transport Security tells the browser to block unencrypted connections even if someone tries to force one. It's a header added on the server.
- Automatic certificate renewal - an expired SSL certificate means a warning for every visitor. Automatic renewal is a must.
WordPress hardening starts with the hosting
Security starts long before the first plugin - on the server itself. Cheap shared hosting is one of the most common reasons for hacks: one infected site on the same server can infect them all. Working with the hosting the right way means:
- Managed hosting, not shared - an isolated environment for each site, with a firewall and automatic server updates, and no dubious neighbors on the same IP.
- A current PHP version - old PHP (7.x and below) is a known security hole. Upgrading to 8.x closes holes and speeds the site up.
- Correct file permissions - 644 for files, 755 for folders, and wp-config locked down. Permissions of 777 are an invitation to a hack.
- An automatic backup off the server - a backup on the same server is deleted together with the site in a hack. An external backup is the real lifeline.
Plugin management - deleting unsafe plugins
Plugins are the number one reason WordPress sites get hacked. Every plugin is someone else's code running on your site, and every extra plugin is one more possible door. My rule is simple: fewer plugins = less risk.
| Type of plugin | Recommendation |
|---|---|
| A plugin that is not in use (even if deactivated) | Delete it now - deactivated code can still be exploited |
| A plugin not updated for over a year | Replace it - abandoned means dangerous |
| A nulled (pirated) plugin | Delete it - the number one source of malware |
| A plugin from a known, maintained source | Keep it and update it regularly |
Recommended security plugins: Wordfence or Solid Security
Wordfence is the most widely used WordPress security plugin - a firewall, malware scanning, login limits and real-time traffic monitoring. Solid Security (formerly iThemes Security) is the alternative, with its own hardening and login protection. Both work, but neither replaces proper hardening of the environment.
That's why my hardening goes a level deeper than any plugin: it hides the WordPress fingerprint, blocks sensitive paths, limits login attempts and closes the common weaknesses at the server level. Instead of ten plugins, one lean layer of protection built from real experience on the attacker's side.
Two-factor authentication (2FA) - the layer that stops a break-in even with a leaked password
Your password can leak without you knowing it - through a hack of another site where you used the same password, through phishing, or through simple brute force. Two-factor authentication makes sure that even if someone holds your password, they can't log in without your phone.
The recommended plugins: WP 2FA (a friendly interface that also supports email codes) or Two Factor (lightweight, TOTP only). Both are free.
Each user connects the account to an app such as Google Authenticator or Authy with a QR code. The app generates a new code every 30 seconds.
2FA must be enforced for all Administrator and Editor users. A subscriber without 2FA is less critical, but it's still worth it.
Hiding the fact that the site runs on WordPress
A technique almost no guide mentions, and one of the most effective against automated attacks. Bots look for the WordPress "fingerprint": the /wp-admin path, the generator tag in the HTML, the /wp-content/ paths. The harder it is to tell the site is WordPress, the fewer bots will bother to attack it.
- Remove the generator tag - remove the
<meta name="generator">tag that announces WordPress and its exact version, which is gold for an attacker. - Change the login page address - moving
/wp-login.phpto a custom address stops most automated brute force attempts before they even start. - Hide the version and the README files - blocking
readme.htmland/wp-includes/keeps versions with known holes from being exposed.
WooCommerce - security risks unique to online stores
A WooCommerce store isn't just another WordPress site. It holds customer data, order details and sometimes payment information. That makes it a high-value target, and it needs extra layers of security.
| A risk unique to WooCommerce | The solution |
|---|---|
| Customer and transaction data | TLS everywhere and encryption of stored customer data |
| Card skimming - stealing card details | Payments only through Stripe or another hosted gateway - never store card details |
| Break-ins to customer accounts | Enforced strong passwords plus 2FA for the admin side |
| SQL injection through order forms | Prepared statements plus a WAF |
| Privacy law and the customer database | A privacy policy, proper data security, reporting serious incidents and deleting data on request |
Docker - isolation that limits the damage
A more advanced setup that makes a real difference: running WordPress inside a Docker container. Instead of every site and the server sharing one environment, each site runs in its own isolated box.
The security advantage: even if an attacker breaks into one site, they're locked inside the container and don't reach the server or the other sites.
Docker also gives a huge advantage in recovery: the whole environment is defined in code, so after a hack a clean environment can be rebuilt in minutes instead of days. It also makes it easy to update the PHP version, run a test environment identical to production, and stop one broken dependency from bringing down the whole server. That's a level of isolation ordinary hosting simply doesn't provide.
Privacy law - what your site owes its users
Privacy law - GDPR in the EU, for example - usually applies to any site that collects data about its users: a name, an email, a phone number, an IP address. It isn't a "recommendation": a violation can lead to fines. Check the rules that apply to you; on the technical side, a WordPress site needs:
- A clear privacy policy - a clear explanation of what data is collected, why and for how long, with a visible link on every form that collects data.
- An encrypted database - if MySQL stores customer details, encrypting the database and using TLS for the connection to it are a must.
- The right to erasure - a customer who asks for their data to be deleted must have it deleted. Plugins such as Complianz or WP GDPR Compliance handle this automatically.
- Breach reporting - a hack that exposed user data may require prompt notice to the data protection authority and to the affected users.
Hacked WordPress: malware removal and recovery, step by step
Hacked? Don't panic - but don't ignore it either. A proper recovery is an orderly process, not guesswork. This is how I handle a hacked site:
Take the site offline or into maintenance mode, change every password (admin, FTP, database, hosting) and cut off the active attack vector.
A malware scan, log analysis and finding the entry point. Without understanding how they got in, the fix won't hold.
Removing the malicious code, the planted files and the backdoors. It's usually better to restore core and plugins from a clean version than to "clean" infected files.
Close the hole they came in through, harden the server and remove the settings that made the attack possible.
If Google flagged the site as dangerous, request a review in Google Search Console after the clean-up. Approval usually takes 24-72 hours.
If the site is down for a reason other than a hack - a white screen, a 500 error, a broken update - see WordPress repair.
5 security mistakes I see again and again
- "It's a small site, who would attack me?"
Attacks are automated - a bot doesn't care how big your business is. A small site gets hacked just like a big one.
- "admin", a weak password and no 2FA
An admin username with a short password falls within minutes. A unique username, a strong password and 2FA are the absolute minimum.
- Dozens of plugins "just in case"
Every plugin is a risk. Extra plugins mean more attack surface, not more security.
- No backup - or a backup on the same server
Without an external backup, one hack wipes out years of work with no way back.
- "I installed a security plugin, done"
Security is an ongoing process, not a one-time setting. Wordfence is one layer out of several.
How much does WordPress security cost?
Most security experts don't publish their prices. These are the realistic ranges:
| Service | Estimated price | What is included |
|---|---|---|
| Basic hardening (one-off) | $220-420 | A scan, server hardening, SSL, 2FA, removing dangerous plugins |
| Monitoring and maintenance | $100-170/month | Website maintenance: updates, scans, backup, a monthly report |
| Hack recovery | $420-970 | Malware clean-up, closing the hole, hardening, restoring the site's standing with Google |
| Penetration test | $330-690 | Finding the holes before an attacker does |
One-off hardening ($220-420) saves a hack recovery ($420-970) - and three lost working days. The cheapest way to deal with a hack is to prevent it. If you're calculating the ROI of security, think about what happens to your business when Google flags your site as dangerous for a week.
Security consulting - doing it right from the start
Focused security consulting, before anything happens, reviews the site, the hosting and the way you work, and marks the gaps before an attacker does. If you're building a new system, it's worth building security in at the planning stage, together with a fractional CTO and proper development, instead of fixing it afterwards.
For deeper work on the site itself, see WordPress expert and PHP developer.
Vadim fixed every problem on my WordPress site in record time. Excellent service, great communication, and a real grasp of the issue from the first moment. Thank you so much for the help - recommended, and definitely the professional you want by your side when something goes wrong with your site.
WordPress security: frequently asked questions
Is WordPress secure?
WordPress itself (the core) is secure and well maintained. Most hacks are not in the core but in plugins, themes, weak passwords or wrong server settings. A properly hardened WordPress site is a hard target; nothing is 100% secure, which is why monitoring stays on.
How much does WordPress security cost?
One-off basic hardening costs $220-420. Ongoing monitoring costs $100-170/month. Hack recovery costs $420-970, depending on how severe the hack is. Investing in prevention is always cheaper than paying for recovery.
My WordPress site was hacked - what do I do now?
Do not delete anything in a panic. The steps: isolate the site, change every password, find the entry point, remove the malicious code, then harden the site so it does not happen again. Without experience, get help from an expert so you do not miss a backdoor.
Is a security plugin like Wordfence enough?
A plugin like Wordfence or Solid Security blocks most automated attacks and is an important layer, but it is not enough on its own. Proper hosting, server hardening, 2FA, plugin management and an external backup matter just as much.
Does a WooCommerce site need special security?
Yes. A WooCommerce store holds customer data and financial transactions, which makes it a high-value target. It needs TLS on every page, protection against SQL injection, encrypted payment data, restricted access to the dashboard and compliance with the privacy law that applies to you.
What is 2FA and how do I turn it on in WordPress?
Two-factor authentication adds a one-time code from an app (Google Authenticator, Authy) to every login. You turn it on with the WP 2FA or Two Factor plugin. Even if the password leaked, nobody can log in without the phone.
Want to know how exposed your site is? Let's find out.
A free 30-minute call, no obligation · reply within 24 hours
Book a free call