Why WordPress Sites Get Hacked
WordPress powers 43% of all websites which makes it the largest target for automated attacks. The vast majority of hacks are not targeted — they are automated scanners looking for known vulnerabilities in outdated plugins, themes, and WordPress core. The good news is that most of these attacks are entirely preventable with basic security hygiene.
Step 1: Keep Everything Updated
Outdated plugins and themes are the primary attack vector for WordPress sites. When a vulnerability is discovered in a plugin, it is published in public databases — and automated scanners immediately start targeting every site still running the vulnerable version. Enable automatic updates for WordPress core minor releases. Review and update plugins and themes weekly. Delete any plugins or themes you are not actively using — deactivated plugins with known vulnerabilities are still exploitable.
Step 2: Use Strong Credentials
Change the default admin username from "admin" to something unique — it is one of the first things brute force tools try. Use a strong randomly generated password for all WordPress user accounts (a password manager makes this practical). Enable two-factor authentication on all admin accounts. Limit login attempts to block brute force attacks.
Step 3: Install a Security Plugin
Wordfence Security is the most comprehensive free option — it provides a web application firewall, malware scanner, brute force protection, and real-time traffic monitoring. For sites running ecommerce or handling sensitive data, Wordfence Premium adds real-time threat intelligence. MalCare is an excellent alternative with instant one-click malware removal that does not impact server performance during scans.
Step 4: Harden Your Login Page
The WordPress login page at /wp-login.php is hammered by automated bots. Change the login URL using a plugin like WPS Hide Login. Enable two-factor authentication. Use Cloudflare's bot protection or Wordfence's brute force protection to block repeated failed login attempts. Consider restricting wp-login.php access by IP if you always log in from known locations.
Step 5: Use HTTPS
Every WordPress site should use HTTPS with a valid SSL certificate. Most quality hosts now provide free SSL via Let's Encrypt. Force all traffic to HTTPS using a 301 redirect. Ensure there are no mixed content warnings (HTTP resources loading on an HTTPS page) — use a plugin like Really Simple SSL to catch these.
Step 6: Implement Regular Backups
Backups do not prevent hacks but they are your recovery plan when one happens. Schedule daily database backups and weekly full site backups to an off-site storage location (not just your hosting server). Test your restore process at least once — a backup you have never tested is an untested assumption. UpdraftPlus makes off-site backup to Google Drive or Dropbox straightforward and free.
Step 7: Limit User Access
Audit your WordPress user accounts. Remove any accounts that are no longer needed. Assign the minimum role necessary for each user — editors do not need administrator access, contributors do not need editor access. If you use a managed hosting control panel, apply the same principle — restrict access to only those who need it.
Step 8: Protect wp-config.php and .htaccess
These files contain sensitive configuration information. Add rules to your .htaccess file to deny direct browser access to wp-config.php. Consider moving wp-config.php one directory above the WordPress root — WordPress will still find it but it is not in the web-accessible directory.
What to Do If You Get Hacked
Take the site offline immediately to prevent further damage and to stop your site spreading malware to visitors. Restore from a known clean backup if you have one from before the infection. If you do not have a clean backup, use a malware removal service — Sucuri and MalCare both offer professional cleanup. Change all passwords (WordPress, hosting, FTP, database). Identify and patch the vulnerability that was exploited before going back online.